Optional ReadonlyprefixOptional ReadonlyprefixOptional ReadonlyprincipalOptional ReadonlyroleOptional ReadonlyroleResolved roles to exclude from the bucket deny statement. Cross-account roles are added to principalExcludes; same-account roles are added to roleExcludeIds.
Readonlys3
Raw role IDs to exclude from the bucket deny statement, for callers which do not hold a resolved role. Callers which pass all of their excludes as
roleExcludescan omit this.