def stop_s3_bucket(client, resource):
    """
    Stop an S3 bucket from being used

    This function will try to
        1. Add lifecycle policy to make sure objects inside it will expire
        2. Block certain access to the bucket
    """

    bucket_policy = {
        'Version': '2012-10-17',
        'Id': 'PutObjPolicy',
        'Statement': [
            {
                'Sid': 'cinqDenyObjectUploads',
                'Effect': 'Deny',
                'Principal': '*',
                'Action': ['s3:PutObject', 's3:GetObject'],
                'Resource': 'arn:aws:s3:::{}/*'.format(resource.id)
            }
        ]
    }

    s3_removal_lifecycle_policy = {
        'Rules': [
            {'Status': 'Enabled',
             'NoncurrentVersionExpiration': {u'NoncurrentDays': 1},
             'Filter': {u'Prefix': ''},
             'Expiration': {
                 u'Date': datetime.utcnow().replace(
                     hour=0, minute=0, second=0, microsecond=0
                 ) + timedelta(days=dbconfig.get('lifecycle_expiration_days', NS_AUDITOR_REQUIRED_TAGS, 3))
             },
             'AbortIncompleteMultipartUpload': {u'DaysAfterInitiation': 3},
             'ID': 'cloudInquisitor'}
        ]
    }

    policy_exists = s3_removal_policy_exists(client, resource)
    lifecycle_policy_exists = s3_removal_lifecycle_policy_exists(client, resource)
    if policy_exists and lifecycle_policy_exists:
        return ActionStatus.IGNORED, {}

    if not policy_exists:
        client.put_bucket_policy(Bucket=resource.id, Policy=json.dumps(bucket_policy))
        logger.info('Added policy to prevent putObject in s3 bucket {} in {}'.format(
            resource.id,
            resource.account.account_name
        ))

    if not lifecycle_policy_exists:
        # Grab S3 Metrics before lifecycle policies start removing objects

        client.put_bucket_lifecycle_configuration(
            Bucket=resource.id,
            LifecycleConfiguration=s3_removal_lifecycle_policy
        )
        logger.info('Added policy to delete bucket contents in s3 bucket {} in {}'.format(
            resource.id,
            resource.account.account_name
        ))

    return ActionStatus.SUCCEED, resource.metrics()
Stop an S3 bucket from being used

    This function will try to
        1. Add lifecycle policy to make sure objects inside it will expire
        2. Block certain access to the bucket