Hi all! I'm just getting started with Pulumi and am running into an issue applying bucket policies. I’ve created an S3 bucket in another region and would like to give an external user access to the bucket via a bucket policy and their ARN. Everything runs successfully and the bucket policy appears as a resource in my Pulumi account, but it’s not being applied to the bucket itself:

region_provider = aws.Provider("region_provider", region='us-east-1)

bucket = aws.s3.BucketV2(
  <bucket_name>,
  bucket=<bucket_name>,
  opts=pulumi.ResourceOptions(
    provider=region_provider,
  ),
)
example_policy = aws.iam.get_policy_document(
  statements=[
    aws.iam.GetPolicyDocumentStatementArgs(
      actions=[
        "s3:GetObject",
      ],
      resources=[
        bucket.arn,
        bucket.arn.apply(lambda arn: f"{arn}/*"),
      ],
      principals=[
        aws.iam.GetPolicyDocumentStatementPrincipalArgs(
          type="AWS",
          identifiers=["<external_user_arn>"],
        )
      ],
    )
  ]
)

aws.s3.BucketPolicy(
  "bucket_policy",
  bucket=bucket.id,
  policy=example_policy.json,
  opts=pulumi.ResourceOptions(
    provider=region_provider,
  ),
)