title: how to use IAM policy variables in terraform code
body: <pre><code>{
    &quot;Sid&quot;: &quot;Allow bucket write&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Principal&quot;: {
      &quot;Service&quot;: [
        &quot;cloudtrail.amazonaws.com&quot;
      ]
    },
    &quot;Action&quot;: &quot;s3:PutObject&quot;,
    &quot;Resource&quot;: &quot;${aws_s3_bucket.log-dev-test-bucket-test.arn}/AWSLogs/${var.organization_id}/${aws:PrincipalAccount}/*&quot;,
    &quot;Condition&quot;: {&quot;StringEquals&quot;: {&quot;s3:x-amz-acl&quot;: &quot;bucket-owner-full-control&quot;}}
  },
  </code></pre>
  <p>I am getting this message on my Resource section with regard to ${aws:PrincipalAccount}:</p>
  <p>&quot;Extra characters after interpolation expression: Template interpolation doesn't expect a colon at this location. Did you intend this to be a literal sequence to be processed as part of another language? If so, you can escape it by starting with &quot;$${&quot; instead of just &quot;${&quot;.HCL&quot;</p>
  <p>The error message is suggesting to use $${aws:PrincipalAccount} to escape it.I don't know what that will do to it because i need to have this IAM policy variable in the policy statement resource section to achieve my goal.can any explain what escape will do if i use $$ instead of $ before {aws:PrincipalAccount}.Thank you</p>