I am creating a design proposal for a data lake hosted in S3. My goal is to create a flat data lake that will host a variety objects within it. The majority of these objects will be made available to the general public, but some will be for internal use only. My proposal is to have a bucket policy that allows only public access for items with a public=true tag implemented. However, this tag should only be able to be changed by users with the correct privileges. Is this something that is possible in S3 with IAM, and if it isn't, what other options that can be utilized to control private/public objects in an S3 data lake?