The second s3 bucket arn shows up as

[Object Object]/*

for me, is there any workaround for this?

let rolePolicy = new aws.iam.RolePolicy(`${name}-s3-access`, {
    role: role.id,
    policy: pulumi.output({
      Version: "2012-10-17",
      Statement: [{
        Effect: "Allow",
        Action: [
          "s3:ListBucket",
          "s3:HeadBucket",
          "s3:PutObject",
          "s3:GetObject"
        ],
        Resource: [ bucket.arn, `${bucket.arn}/*` ]
      }]
    }).apply(JSON.stringify)
  }, {
    parent: role
  });

That's right - you no longer need to convert to a string. See https://pulumi.io/reference/pkg/nodejs/@pulumi/aws/iam/#RolePolicyArgs-policy which calls out that this now accepts either a string or a

PolicyDocument

interface.