the account to default s3.bucketOwnerAccountId to (the deploying
account). Required and must be non-empty — a caller must supply it (typically
Stack.of(scope).account) so the confused-deputy protection cannot be bypassed by omitting it.
This function is scopeless (pure), so it cannot resolve the account itself.
Builds the typed CFN tool schema for a Lambda target from the validated config. Exactly one of
inlinePayload/s3is set (enforced by validateLambdaToolSource).For an S3 tool schema,
bucketOwnerAccountId(cross-account confused-deputy protection) is applied compliance-by-default: when the caller omits it (or passes an empty string), it defaults todeployingAccountso the gateway always verifies the bucket owner on the cross-account read. An explicit non-empty value is always respected. This default is enforced here so the protection holds regardless of the consumer — an empty string cannot bypass it.