the other example also works when replacing bucket.arn with bucket.id. The documentation says:

S3 Bucket to which this Public Access Block configuration should be applied.

It’s not clear that it’s talking about the bucket name. I guess I got the idea that it should be an ARN from the bucket parameter of s3.Bucket(), where it says:

bucket (pulumi.Input[str]) – The ARN of the S3 bucket where you want Amazon S3 to store replicas of the object identified by the rule.

I assumed it expects the same thing because the parameter name is the same.