So how is it that Pulumi can track the dependency of a Policy Attachment to a User, but not a bucket or another resource?