CloudFormation returned status code: Forbidden

When does cloud formation returns `Forbidden` status? This happened with me during `create`. I had a code where a the Lambda was supposed to upload file to S3 bucket and while that went successful the template got stuck!

Here is what the log looks like

```
[DEBUG] 2020-07-21T15:02:51.816Z 8f3cc89a-9521-4272-82cc-587d7e8a0d4b Executing task PutObjectTask(transfer_id=0, {'bucket': 'my_bucket_name', 'key': 'faq_document.xlsx', 'extra_args': {}}) with kwargs {'client': , 'fileobj': , 'bucket': 'my_bucket_name', 'key': 'faq_document.xlsx', 'extra_args': {}}
[DEBUG] 2020-07-21T15:03:23.593Z 8f3cc89a-9521-4272-82cc-587d7e8a0d4b Releasing acquire 0/None
[INFO] 2020-07-21T15:03:23.594Z 8f3cc89a-9521-4272-82cc-587d7e8a0d4b File `faq_document.xlsx` uploaded successfully
[DEBUG] 2020-07-21T15:03:23.597Z 8f3cc89a-9521-4272-82cc-587d7e8a0d4b enabling send_response
[DEBUG] 2020-07-21T15:03:23.616Z 8f3cc89a-9521-4272-82cc-587d7e8a0d4b _send_response: True
[DEBUG] 2020-07-21T15:03:23.617Z 8f3cc89a-9521-4272-82cc-587d7e8a0d4b CFN response URL: https://cloudformation-custom-resource-response-my_region.s3.amazonaws.com ..........
[DEBUG] 2020-07-21T15:03:23.617Z 8f3cc89a-9521-4272-82cc-587d7e8a0d4b
{
"Status": "SUCCESS",
"PhysicalResourceId": "S3PostAutoID000",
"StackId": "arn:aws:cloudformation:my_region:my_account:stack/stack-cb3/f0da78d0-cb60-11ea-bbd9-0e3259ee6b3b",
"RequestId": "0bed6b99-a998-49c0-933d-81386cad65be",
"LogicalResourceId": "CustomS3Postrequisites",
"Reason": "",
"Data": {}
}
[INFO] 2020-07-21T15:03:23.843Z 8f3cc89a-9521-4272-82cc-587d7e8a0d4b CloudFormation returned status code: Forbidden
END RequestId: 8f3cc89a-9521-4272-82cc-587d7e8a0d4b
```

Its strange though never happened before, although one question, Am I suppose to randomize my `PhysicalResourceId`?, because right now its plain text

```
@helper.create
def create(event, _):
try:
bucket_name = event['ResourceProperties']['BucketName']
s3 = boto3.resource('s3')
s3.meta.client.upload_file('faq_document.xlsx', bucket_name, 'faq_document.xlsx')
logger.info("File `faq_document.xlsx` uploaded successfully")
except Exception as _:
logger.critical(traceback.format_exc())

return "S3PostAutoID000"
```

Start at the @helper.create handler and the logged CloudFormation response URL; trace how the helper sends the SUCCESS response after the S3 upload. Compare the returned PhysicalResourceId and request context with CloudFormation's response requirements, using the provided log to isolate why the response is Forbidden. Done means the cause is documented and the report can be reproduced or ruled out.

Written by the indexing model from the issue text.