Attaching AWS::S3::BucketPolicy hangs forever on CREATE_IN_PROGRESS

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest v3 release?

• Yes, I'm using the latest v3 release

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

When attempting to create an AWS::S3::Bucket and then attach an AWS::S3::BucketPolicy to it, the AWS::S3::BucketPolicy will hang forever in the CREATE_IN_PROGRESS state. To ensure I was not doing something wrong here, I modified my CloudFormation template in the designer and ensured it was valid, which was confirmed. I then attempted to roll out this same stack with CloudFormation directly, successfully.

For reference, here is the applicable portion of the cloudformation.yml / serverless.yml

serverless.yml

  BuildStorageBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: ${self:provider.environment.DOWNLOADS_STORAGE_BUCKET_NAME}
      OwnershipControls:
        Rules:
          - ObjectOwnership: ObjectWriter
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false
  BuildStorageBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
        Bucket: !Ref BuildStorageBucket
        PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: AllowPublicReadAccess
                Effect: Allow
                Principal: '*'
                Resource: !Sub 'arn:aws:s3:::${BuildStorageBucket}/*'
                Action:
                  - 's3:GetObject'
    DependsOn:
      - BuildStorageBucket

cloudformation.yml

  BuildStorageBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: dev-downloads-storage
      OwnershipControls:
        Rules:
          - ObjectOwnership: ObjectWriter
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false
    Metadata:
      'AWS::CloudFormation::Designer':
        id: dbdc4cce-6b8d-4982-b2c4-1bc7cbe89300
  BuildStorageBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
        Bucket: !Ref BuildStorageBucket
        PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: AllowPublicReadAccess
                Effect: Allow
                Principal: '*'
                Resource: !Sub 'arn:aws:s3:::${BuildStorageBucket}/*'
                Action:
                  - 's3:GetObject'
    Metadata:
      'AWS::CloudFormation::Designer':
        id: cbbd0a28-7974-45d9-b6c3-31f161bfcc82
    DependsOn:
      - BuildStorageBucket

Noting that the only difference between these two are the Metadata blocks and the bucket name replacement.

I am unsure of if this is explicitly an aws thing or a serverless thing, but it does work from the AWS Console so I figured bringing it up here is worthwhile. If I remove the AWS::S3::BucketPolicy from the serverless.yml, the stack and updates deploy without issue.

Service configuration (serverless.yml) content

N/A

Command name and used flags

sls deploy --stage dev --verbose

Command output

Deploying to stage dev
global › waiting
storage-authorizer › waiting
func-lambdas › waiting
apollo-server › waiting
serverOutputs › waiting
clientOutputs › waiting
global › deploying
global › Running "serverless deploy --stage dev"
global › Running "serverless" from node_modules
global › Deploying global to stage dev (us-east-2)
global › Uploading CloudFormation file to S3
global › Uploading State file to S3
global › Creating new change set
global › Waiting for new change set to be created
global › Change Set did not reach desired state, retrying
global › Executing created change set
global › UPDATE_IN_PROGRESS - AWS::CloudFormation::Stack - global-dev
global › CREATE_IN_PROGRESS - AWS::DynamoDB::Table - connectionsTable
global ›   CREATE_IN_PROGRESS - AWS::DynamoDB::Table - MembershipsTable
global ›   CREATE_IN_PROGRESS - AWS::S3::Bucket - SessionStorageBucket
global ›   CREATE_IN_PROGRESS - AWS::DynamoDB::Table - subscriptionsTable
global ›   CREATE_IN_PROGRESS - AWS::S3::Bucket - BuildStorageBucket
global › CREATE_IN_PROGRESS - AWS::DynamoDB::Table - ConfigurationsTable
global ›   CREATE_IN_PROGRESS - AWS::DynamoDB::Table - WorkspaceTable
global ›   CREATE_IN_PROGRESS - AWS::Cognito::UserPool - CognitoUserPool
global ›   CREATE_IN_PROGRESS - AWS::S3::Bucket - BuildStorageBucket
global ›   CREATE_IN_PROGRESS - AWS::S3::Bucket - SessionStorageBucket
global ›   CREATE_IN_PROGRESS - AWS::DynamoDB::Table - connectionsTable
global ›   CREATE_IN_PROGRESS - AWS::DynamoDB::Table - MembershipsTable
global ›   CREATE_IN_PROGRESS - AWS::DynamoDB::Table - subscriptionsTable
global ›   CREATE_IN_PROGRESS - AWS::DynamoDB::Table - WorkspaceTable
global ›   CREATE_IN_PROGRESS - AWS::DynamoDB::Table - ConfigurationsTable
global › CREATE_IN_PROGRESS - AWS::Cognito::UserPool - CognitoUserPool
global ›   CREATE_COMPLETE - AWS::Cognito::UserPool - CognitoUserPool
global › CREATE_IN_PROGRESS - AWS::Cognito::UserPoolClient - CognitoUserPoolClient
global ›   CREATE_IN_PROGRESS - AWS::Cognito::UserPoolClient - CognitoUserPoolClient
global ›   CREATE_COMPLETE - AWS::Cognito::UserPoolClient - CognitoUserPoolClient
global ›   CREATE_IN_PROGRESS - AWS::Cognito::IdentityPool - CognitoIdentityPool
global ›   CREATE_IN_PROGRESS - AWS::Cognito::IdentityPool - CognitoIdentityPool
global › CREATE_COMPLETE - AWS::Cognito::IdentityPool - CognitoIdentityPool
global › CREATE_COMPLETE - AWS::DynamoDB::Table - connectionsTable
global ›   CREATE_COMPLETE - AWS::DynamoDB::Table - ConfigurationsTable
global › CREATE_COMPLETE - AWS::S3::Bucket - BuildStorageBucket
global ›   CREATE_COMPLETE - AWS::S3::Bucket - SessionStorageBucket
global › CREATE_COMPLETE - AWS::DynamoDB::Table - MembershipsTable
global ›   CREATE_COMPLETE - AWS::DynamoDB::Table - WorkspaceTable
global ›   CREATE_COMPLETE - AWS::DynamoDB::Table - subscriptionsTable
global ›   CREATE_IN_PROGRESS - AWS::S3::BucketPolicy - BuildStorageBucketPolicy
global › CREATE_IN_PROGRESS - AWS::S3::BucketPolicy - BuildStorageBucketPolicy

    ⠇  global › deploying › 829s
       storage-authorizer › waiting
       func-lambdas › waiting
       apollo-server › waiting
       serverOutputs › waiting
       clientOutputs › waiting

Environment information

Framework Core: 3.36.0
Plugin: 7.1.0
SDK: 4.4.0

Begin with the CloudFormation resource definitions in serverless.yml and cloudformation.yml, then reproduce the issue with sls deploy --stage dev --verbose using the AWS::S3::BucketPolicy example. Compare the deployment with the direct CloudFormation behavior described in the report. Done means the stack progresses past CREATE_IN_PROGRESS for BuildStorageBucketPolicy.