Seems that when I work locally, the ARN output of an S3 bucket is missing “aws”, ie

arn::s3:::bucket

vs

arn:aws:s3:::bucket

as for the lambda layer issue, I may need localstack Pro