I would expect CallbackFunction policies to accept Input<string>[] rather than string[] to avoid extra wrapping around freshly created policies

That’s a good point — thanks for pointing it out. I’ve filed https://github.com/pulumi/pulumi-aws/issues/995