Figured out that the user ARN wasn't coming through for some reason. It looks like there is some kind of time out on the user creation that results in a null ARN being fed into the role policy. I thought that using the

depends_on

ResourceOption parameter would gate the policy document on the user creation. Have I done something wrong, or is there a setting that needs to be applied? For context, the user creation looks like this:

user = iam.User(
        "pulumi_user",
        name=construct_iam_resource_name("iam_deployment"),
        path=automata_iam_path,
        tags={"purpose": "Account used to perform Pulumi stack updates on CI/CD."},
    )

    user_arn = user.arn.apply(lambda arn: arn)

    instance_assume_role_policy = iam.get_policy_document(
        opts=pulumi.ResourceOptions(depends_on=[user]),
        statements=[
            {
                "actions": ["sts:AssumeRole"],
                "effect": "Allow",
                "principals": [{"identifiers": [user_arn], "type": "AWS"}],
            },
        ],
        version="2012-10-17",
    )