i then can do things like this:

// Grant Cloudfront access to the content bucket
		_, err = s3.NewBucketPolicy(ctx, "staticSitePolicy-"+host, &s3.BucketPolicyArgs{
			Bucket: bucket.Bucket.Bucket,
			Policy: pulutil.JSONTemplate(map[string]interface{}{
				"BucketARN":   bucket.BucketArn,
				"IdentityARN": identity.IamArn,
			}, `{
						"Version": "2012-10-17",
						"Id": "PolicyForCloudFrontPrivateContent",
						"Statement": [
							{
								"Effect": "Allow",
								"Principal": {
									"AWS": "{{ .IdentityARN }}"
								},
								"Action": "s3:GetObject",
								"Resource": "{{ .BucketARN }}/*"
							}
						]
					}`),
		})

the template there is just a normal Go template..

JSONTemplate

just does an additional check at the end to make sure the output is valid JSON before handing it off to Pulumi; get more useful error messages that way

meanwhile I can try

ApplyT