title: Wildcard at end of principal for s3 bucket
body: <p>I want to allow roles within an account that have a shared prefix to be able to read from an S3 bucket. For example, we have a number of roles named <code>RolePrefix1</code>, <code>RolePrefix2</code>, etc, and may create more of these roles in the future. We want all roles in an account that begin with <code>RolePrefix</code> to be able to access the S3 bucket, without having to change the policy document in the future.</p>
  
  <p>My terraform for bucket policy document is as below:</p>
  
  <pre class="lang-py prettyprint-override"><code>data "aws_iam_policy_document" "bucket_policy_document" {
    statement {
      effect = "Allow"
      actions = ["s3:GetObject"]
  
      principals = {
        type = "AWS"
        identifiers = ["arn:aws:iam::111122223333:role/RolePrefix*"]
      }
  
      resources = ["${aws_s3_bucket.bucket.arn}/*"]
    }
  }
  </code></pre>
  
  <p>This gives me the following error:</p>
  
  <p><code>Error putting S3 policy: MalformedPolicy: Invalid principal in policy</code>. </p>
  
  <p>Is it possible to achieve this functionality in another way?</p>