title: Malformed S3 policy from Terraform
body: <p>Looks like I'm getting a malformed policy as part of my Terraform deployment and am not seeing any issue(s) with it while looking it over, all the <code>Principals</code> seem to be in place and nothing looks <em>out of the ordinary</em>. Can someone pick out why this policy is being considered malformed?</p>
  
  <p>Here's the TF output that is throwing</p>
  
  <pre><code>module.s3-bucket.aws_s3_bucket_policy.bucket_policy: Creating...
    bucket: "" =&gt; "the_s3_bucket"
    policy: "" =&gt; "{\n  \"Version\":\"2012-10-17\",\n    \"Statement\":[{\n      \"Principal\": \"*\",\n      \"Action\":[\n        \"s3:GetBucketLocation\",\n        \"s3:ListAllMyBuckets\"\n      ],\n        \"Resource\":[\n          \"arn:aws:s3:::*\"\n      ],\n    \"Effect\":\"Allow\"\n  }, {\n    \"Principal\": \"*\",\n    \"Action\":[\n      \"s3:ListBucket\",\n      \"s3:ListBucketMultipartUploads\"\n    ],\n    \"Resource\":[\n      \"arn:aws:s3:::the_s3_bucket\"\n    ],\n    \"Effect\":\"Allow\"\n    }, {\n      \"Principal\": \"*\",\n    \"Action\":[\n      \"s3:GetObject\",\n      \"s3:AbortMultipartUpload\",\n      \"s3:ListMultipartUploadParts\",\n      \"s3:DeleteObject\",\n      \"s3:PutObject\",\n      \"s3:GetObjectAcl\",\n      \"s3:PutObjectAcl\"\n    ],\n    \"Resource\":[\n      \"arn:aws:s3:::the_s3_bucket/*\"\n    ],\n    \"Effect\":\"Allow\"\n  }]\n}\n"
  </code></pre>
  
  <p>The (non-verbose)    Error: </p>
  
  <pre><code>Error applying plan:
  
  1 error(s) occurred:
  
  * module.s3-bucket.aws_s3_bucket_policy.bucket_policy: 1 error(s) occurred:
  
  * aws_s3_bucket_policy.bucket_policy: Error putting S3 policy: MalformedPolicy: Policy has invalid action
      status code: 400, request id: DCAEB510D9FE431C, host id: FwZ187PM8RKZljAZGo1578UvsgW3kwtZpaI2Mom46lu7Jr+NV9Jum8txjsfwdJw0jm9ct0awRWk=
  </code></pre>
  
  <p>Here's a <em>pretty print</em> of what it contains</p>
  
  <pre><code>{
    "Version":"2012-10-17",
      "Statement":[{
        "Principal": "*",
        "Action":[
          "s3:GetBucketLocation",
          "s3:ListAllMyBuckets"
        ],
          "Resource":[
            "arn:aws:s3:::*"
        ],
      "Effect":"Allow"
    }, {
      "Principal": "*",
      "Action":[
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource":[
        "arn:aws:s3:::the_s3_bucket"
      ],
      "Effect":"Allow"
      }, {
        "Principal": "*",
      "Action":[
        "s3:GetObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts",
        "s3:DeleteObject",
        "s3:PutObject",
        "s3:GetObjectAcl",
        "s3:PutObjectAcl"
      ],
      "Resource":[
        "arn:aws:s3:::the_s3_bucket/*"
      ],
      "Effect":"Allow"
    }]
  }
  </code></pre>
  
  <p><strong>Update</strong></p>
  
  <p>So evidently this has something to do with the <code>Principal</code> field, after running this through AWS Console I get the error</p>
  
  <pre><code>This policy contains the following error: Has prohibited field Principal For more information about the IAM policy grammar, see AWS IAM Policies 
  </code></pre>