Hi, I'm trying to using a bucket with cross-account permission, but it fails during 'pulumi up'. Anyone who knows what permissions needs to be assigned in the bucket policy?

aws:s3:Bucket (srcConfig):
    error: Preview failed: refreshing urn:pulumi:dev::ts::aws:s3/bucket:Bucket::srcConfig: 1 error occurred:
    	* error reading S3 Bucket (aaaaa): BadRequest: Bad Request
    	status code: 400, request id: 411AC7A2EAE77462, host id: wg9X8hI45FSMSck7azalz1D3AG1WuFpC93zPrtKX+Z+Ph3aGoeDn+hWWSW96ElvfrdVyHQuxY8E=

Have a look in CloudWatch for the UnauthorizedApiCall error, iirc it tells you which permissions are missing?