This message was deleted.

Solved my own problem 🙂 Just needed to put the entire

iam.get_policy_document

call inside of the

bucket.arn.apply

lambda, like this

my_bucket.arn.apply(
    lambda bucket_arn:
        iam.get_policy_document(...)
).json

the above produces

Output[str]

which I can then feed to

iam.PolicyArg

I'm using C# but for the record, the expression iam.get_policy_document() can be evaluated outside of the apply lambda. It's just accessing properties of the result needs to be done inside the apply().