S3BucketPolicy - Invalid principal in policy error

[tetiana-fomina-photobox]

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest version?

• Yes, I'm using the latest version

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

Hello, I faced with the problem when I try to create s3 bucket policy where principal equals role ARN (like this: https://aws.amazon.com/premiumsupport/knowledge-center/s3-invalid-principal-in-policy-error/).
Below you can see how I create my policy for bucket:

const s3BucketPolicy: CloudFormationResource = {
  Type: 'AWS::S3::BucketPolicy',
  Properties: {
    PolicyDocument: {
      Statement: [
        {
          Sid: 'myPolicy',
          Effect: 'Allow',
          Action: ['s3:*'],
          Resource: { 'Fn::Join': ['', [{ 'Fn::GetAtt': [s3BucketResource.name, 'Arn'] }, '/*']] },
          Principal: {
            AWS: ['${self:custom.env.s3.myRole}'], // arn of needed role
          },
        },
      ],
    },
    Bucket: { Ref: myBucket.name },
  },
};

I have correct builded CloudFormation in my .serverless folder:

"S3BucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Sid": "myPolicy",
              "Effect": "Allow",
              "Action": [
                "s3:*"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    {
                      "Fn::GetAtt": [
                        "S3Bucket",
                        "Arn"
                      ]
                    },
                    "/*"
                  ]
                ]
              },
              "Principal": {
                "AWS": [
                  arn:aws:iam::<accountId>:role/<roleName>
                ]
              }
            }
          ]
        },
        "Bucket": {
          "Ref": "S3Bucket"
        }
      }
    }

But when I am deploying my code I get An error occurred: S3BucketPolicy - Invalid principal in policy (Service: Amazon S3; Status Code: 400; Error Code: MalformedPolicy; Request ID:....).
What may cause that ?
I want to clarify that if I set principal equals account id (instead of role ARN), I get "arn:aws:iam:::root" in Cloudformation and no issues in deployment

Service configuration (serverless.yml) content

const s3BucketPolicy: CloudFormationResource = {
  Type: 'AWS::S3::BucketPolicy',
  Properties: {
    PolicyDocument: {
      Statement: [
        {
          Sid: 'myPolicy',
          Effect: 'Allow',
          Action: ['s3:*'],
          Resource: { 'Fn::Join': ['', [{ 'Fn::GetAtt': [s3BucketResource.name, 'Arn'] }, '/*']] },
          Principal: {
            AWS: ['${self:custom.env.s3.myRole}'], // arn of needed role
          },
        },
      ],
    },
    Bucket: { Ref: myBucket.name },
  },
};

Command name and used flags

sls deploy -v --stage //needed stage//

Command output

An error occurred: S3BucketPolicy - Invalid principal in policy (Service: Amazon S3; Status Code: 400; Error Code: MalformedPolicy; Request ID: ***; S3 Extended Request ID: ***; Proxy: null).

Environment information

Framework Core: 2.69.0 (local)
Plugin: 5.5.1
SDK: 4.3.0
Components: 3.18.1

[medikoo]

I'm moving it to discussions, as it's not a bug report but request for help on CF template setup

[pgrzesik]

Hello @tetiana-fomina-photobox 👋 I believe that in cases where the principal is only one user, you need to provide it directly as a string, not as a list that has a single element as it's not considered a valid format by AWS. List format is accepted only if there's more than one user specified.

[tetiana-fomina-photobox]

Hello, @pgrzesik Thank you, you are right, it helped 👍

[pgrzesik]

Hello @tetiana-fomina-photobox, great to hear that 🙌

[jbmarflo]

Hi @pgrzesik yes it worked for me. Thanks a lot.
Principal: AWS: 'arn:aws:iam::xxxxxxxxxxx:user/xxxxxxxx'