I have the following simplified resource:

new aws.s3.BucketPolicy("pulumi-infrastructure-bucket-policy", {
        bucket: bucket.bucket,
        policy: 
            `
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::infrastructure.pulumi.dev",
                "arn:aws:s3:::infrastructure.pulumi.dev/*"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}`,
    });

I would like to make those two Resource definitions dynamic, but when I switch to the

${bucket.arn}

notation I get an error that my string literal contains a

\n

somehow. Even though I am inside a backticks backed string.

arn

is an output, you can't use that with backtick formatting. Look at the docs at https://www.pulumi.com/docs/concepts/inputs-outputs/#outputs-and-strings and for JSON policies like this https://www.pulumi.com/docs/concepts/inputs-outputs/#outputs-and-json

@echoing-dinner-19531 Yeah, I wrapped my whole stack in a

const main = async () => {} …

construct and made the wrong assumption that a

const bucket = await new aws.s3.bucket()

would resolve the Promise/Output.

Yeh no worries, output values are the most unusual part of the Pulumi SDKs. Nearly everyone trips up on them first day.

Hehe, yes. I thought I had mastered them, but my naive thinking of await new .. threw me off track. 🙂