No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

I am having issue getting promised value working inside of `aws.iam.getPolicyDocument`, I feel there maybe some reason on when the `getPolicyDocument` get interpolated.

Here is my code:
```  const role = new aws.iam.Role(
    `${redshiftName}-s3-access-role`,
    {
     ...
    },
    { provider: config.providers[configEnvironment] as aws.Provider },
  );
  const keyPolicy = aws.iam.getPolicyDocument(
    {
      statements: [
        {
          actions: ['kms:Encrypt'],
          effect: 'Allow',
          principals: [
            {
              type: 'AWS',
              identifiers: [`${role?.arn}`],
            },
          ],
          resources: ['*'],
          sid: 'Allow use of the key.',
        },
      ],
    },
  );```

This is the error message:
```[0]: "Calling [toString] on an [Output&lt;T&gt;] is not supported.\n\nTo get the value of an Output&lt;T&gt; as an Output&lt;string&gt; consider either:\n1: o.apply(v =&gt; `prefix${v}suffix`)\n2: pulumi.interpolate `prefix${v}suffix`\n\nSee <https://pulumi.io/help/outputs> for more details.\nThis function may throw in a future version of @pulumi/pulumi."```

That's right. getPolicyDocument isn't a resource constructor and doesn't handle Input values like resources do.
You need to either put the entire call to getPolicyDocument inside a call to apply, or use the PolicyDocument type instead. I recommend using the type. It should be as simple as removing the call to getPolicyDocument. I think the rest of it should just work.