This message was deleted.

You need the name of the S3 bucket to mention it in the bucket policy, but need to have the bucket policy in order to create the S3 bucket. Do I have that right? If it is just the name of the S3 bucket, you can rely on the harded-coded value you provide for

bucketName

e.g. “uploads-bucket” and “s3://uploads-bucket”. But that obviously won’t work if you are relying on Pulumi to name the bucket for you.

You understand the problem precisely.

Yes, precisely. That will set the name property of the resource directly, which also means that it needs to be globally unique since the “S3 bucket namespace” is shared with all other S3 buckets.

Excellent. That'll do the trick. Thank you very much.

@modern-diamond-82589 You may want to look at the

aws.s3.BucketPolicy

resource, which allows you to attach a bucket policy to an existing bucket.

That could be what I was looking for all along. The example looks like the very thing I'm trying to accomplish. I'll report back with success/failure.

There was a marked change in the design of the Terraform provider for AWS about ~3 years ago when separate resources started being preferred for things like policies and (e.g.) security group rules vs nested blocks - precisely because of this problem