how do i get the arn as a string that i can pass to a policy document?

You cannot turn an output into string. You can transform the output into a new value by writing code inside the callback to apply. For a policy document, you will want your apply callback to construct the document and then lass the resulting output (now representing the document) as an input to a resource. See https://www.pulumi.com/docs/intro/concepts/programming-model/#outputs for more details.

ah, ok. i think that makes sense. thanks @white-balloon-205