Document exactly what permissions [s3 main] and [s3 alt] user_id's should have

It seems the "s3 main" user must be able to create buckets and the "s3 alt" user must be able to set the bucket acl even when the bucket was created by the "[s3 main]" user_id?
So should both users have *all* permissions on the account? What are the *minimum* set of permissions (policy actions) they can have?
```
[s3 main]
## the tests assume two accounts are defined, "main" and "alt".
...
[s3 alt]
## another user account, used for ACL-related tests
```

Locate the test configuration sections labeled [s3 main] and [s3 alt], then trace the ACL-related tests that use those accounts. Document the minimum policy actions required for each account, including bucket creation and setting a bucket ACL, and verify that the documented permissions match the test expectations.

Written by the indexing model from the issue text.