Nope, I get the same error with a bucket that does have a policy set. And I can retrieve it with aws-cli using the same profile as the one used by pulumi.