oh I see the message now.

apply(v => v.toJSON())

This example (in Go) illustrates how to construct an IAM policy from the ARN of another resource: https://github.com/pulumi/github-issue-automation/blob/main/pulumi/main.go#L108-L139