title: Incorrect S3 bucket policy is detected for bucket in CloudFormation
body: <p>I have issues implementing CloudTrail via Cloudformation, with a Incorrect S3 bucket policy is detected for bucket error being thrown when I try to launch the model.</p>
  
  <p>Here is the configuration from the BucketPolicy:</p>
  
  <pre><code>"LogBucketPolicy": {
          "Type": "AWS::S3::BucketPolicy",
          "Properties": {
              "Bucket": {
                  "Ref": "LogBucket"
              },
              "PolicyDocument": {
                  "Version": "2012-10-17",
                  "Statement": [
                      {
                          "Sid": "AWSCloudTrailAclCheck",
                          "Effect": "Allow",
                          "Principal": {
                              "Service": "cloudtrail.amazonaws.com"
                          },
                          "Action": "s3:GetBucketAcl",
                          "Resource": {
                              "Fn::Join": [
                                  "",
                                  [
                                      "arn:aws:s3:::",
                                      {
                                          "Ref": "LogBucket"
                                      }
                                  ]
                              ]
                          }
                      },
                      {
                          "Sid": "AWSCloudTrailWrite",
                          "Effect": "Allow",
                          "Principal": {
                              "Service": "cloudtrail.amazonaws.com"
                          },
                          "Action": "s3:PutObject",
                          "Resource": {
                              "Fn::Join": [
                                  "",
                                  [
                                      "arn:aws:s3:::",
                                      {
                                          "Ref": "LogBucket"
                                      },
                                      "/AWSLogs/139339407673/*"
                                  ]
                              ]
                          },
                          "Condition": {
                              "StringEquals": {
                                  "s3:x-amz-acl": "bucket-owner-full-control"
                              }
                          }
                      }
                  ]
              }
          }
      }
  </code></pre>
  
  <p>I have copied the template from AWS examples, but let me know if I did a mistake in the implementation.</p>
  
  <p>Edit: The error is not thrown by the bucket policy, but by CloudTrail. Here is the configuration of the bucket:</p>
  
  <pre><code>"Trail": {
          "Type": "AWS::CloudTrail::Trail",
          "Properties": {
              "SnsTopicName": {
                  "Fn::GetAtt": [
                      "Topic",
                      "TopicName"
                  ]
              },
              "IsLogging": true,
              "S3BucketName": {
                  "Ref": "LogBucket"
              }
          },
          "DependsOn": [
              "LogBucket"
          ]
      }
  </code></pre>