pulumi.All(clusterOidcProviderUrl, clusterOidcProvider.ARN, appsNamespaceName).ApplyT(func(all []interface{}) (*iam.GetPolicyDocumentResult, error) {
	doc, err := iam.GetPolicyDocument(ctx, &iam.GetPolicyDocumentArgs{
		Statements: []iam.GetPolicyDocumentStatement{
			iam.GetPolicyDocumentStatement{
				Actions: []string{
					"sts:AssumeRoleWithWebIdentity",
				},
				Conditions: []iam.GetPolicyDocumentStatementCondition{
					iam.GetPolicyDocumentStatementCondition{
						Test:     "StringEquals",
						Variable: strings.Replace(all[0].(string), "https://", "") + ":sub",
						Values: []string{
							fmt.Sprintf("system:serviceaccount:%s:%s", all[2].(string), "s3"),
						},
					},
				},
				Effect: "Allow",
				Principals: []iam.GetPolicyDocumentStatementPrincipal{
					iam.GetPolicyDocumentStatementPrincipal{
						Identifiers: []string{all[1].(pulumi.URN)}
					},
				},
			},
		},
	}, nil)

	if err != nil {
		return nil, err
	}

	return doc, nil
})