AWS::Backup::BackupPlan - AdvancedBackupSettings S3 support - BackupACLs / BackupObjectTags

### Name of the resource

AWS::Backup::BackupPlan

### Resource name

AWS::Backup::BackupPlan

### Description

## Summary

CloudFormation's `AdvancedBackupSettings` for `AWS::Backup::BackupPlan` currently only supports
`ResourceType: EC2` (Windows VSS). There is no way to configure S3-specific advanced backup
options such as `BackupACLs` and `BackupObjectTags` via CloudFormation.

## Current Behavior

Specifying `ResourceType: S3` in `AdvancedBackupSettings` causes an Early Validation error:

```yaml
AdvancedBackupSettings:
- ResourceType: S3 # ❌ Causes Early Validation error
BackupOptions:
BackupACLs: disabled
BackupObjectTags: disabled

Expected Behavior

AdvancedBackupSettings should support ResourceType: S3 with the following options:

AdvancedBackupSettings:
- ResourceType: S3
BackupOptions:
BackupACLs: disabled # Enable/disable ACL backup
BackupObjectTags: disabled # Enable/disable object tag backup

Why This Matters

The AWS Backup API already supports these settings for S3 via UpdateBackupPlan.
This is purely a CloudFormation schema gap.

As a workaround, we are forced to run aws backup update-backup-plan via CLI
in our deployment scripts after CloudFormation deployment, adding operational complexity
and making our infrastructure definition incomplete as IaC.

Workaround (Current)

PLAN=$(aws backup get-backup-plan --backup-plan-id "$PLAN_ID")
UPDATED=$(echo "$PLAN" | jq '.BackupPlan | del(.Rules[].RuleId) | . + {
"AdvancedBackupSettings": [{
"ResourceType": "S3",
"BackupOptions": {
"BackupACLs": "disabled",
"BackupObjectTags": "disabled"
}
}]
}')
aws backup update-backup-plan \
--backup-plan-id "$PLAN_ID" \
--backup-plan "$UPDATED"

References

- AWS Backup Developer Guide - Advanced backup settings
- UpdateBackupPlan API

### Other Details

_No response_

Start at the AWS::Backup::BackupPlan resource's AdvancedBackupSettings schema and compare its validation with the UpdateBackupPlan API behavior described in the issue. Verify support for ResourceType: S3 with BackupACLs and BackupObjectTags, then confirm the example no longer produces an early validation error.

Written by the indexing model from the issue text.