title: Unable to write policy document in aws cdk using python
body: <p>Hi I am working on AWS CDK. I am trying to create policy. Below is my code.</p>
  
  <pre><code>MWSECSServiceRole = iam.Role(self, 'MWSECSServiceRole',
            assumed_by=iam.ServicePrincipal('ecs.amazonaws.com'))
  
          MWSECSServiceRole.add_to_policy(iam.PolicyStatement(
          effect=iam.Effect.ALLOW,
          resources=["arn:aws:elasticloadbalancing:*:{AccountId}:loadbalancer/app/mws-*","arn:aws:elasticloadbalancing:*:{AccountId}:listener-rule/app/mws-*","arn:aws:elasticloadbalancing:*:{AccountId}:listener/app/mws-*","arn:aws:elasticloadbalancing:*:{AccountId}:targetgroup/mws-*"],
          actions=["elasticloadbalancing:DeregisterInstancesFromLoadBalancer","elasticloadbalancing:DeregisterTargets","elasticloadbalancing:RegisterInstancesWithLoadBalancer","elasticloadbalancing:RegisterTargets"]
          ))
  
          MWSECSServiceRole.add_to_policy(iam.PolicyStatement(
          effect=iam.Effect.ALLOW,
          resources=["*"],
          actions=["ec2:AuthorizeSecurityGroupIngress","ec2:Describe*","elasticloadbalancing:Describe*"]
          ))
  </code></pre>
  
  <p>Which will generate below cloud formation template.</p>
  
  <pre><code>MWSECSServiceRoleDefaultPolicyD5E258B0:
      Type: AWS::IAM::Policy
      Properties:
        PolicyDocument:
          Statement:
            - Action:
                - elasticloadbalancing:DeregisterInstancesFromLoadBalancer
                - elasticloadbalancing:DeregisterTargets
                - elasticloadbalancing:RegisterInstancesWithLoadBalancer
                - elasticloadbalancing:RegisterTargets
              Effect: Allow
              Resource:
                - arn:aws:elasticloadbalancing:*:{AccountId}:loadbalancer/app/mws-*
                - arn:aws:elasticloadbalancing:*:{AccountId}:listener-rule/app/mws-*
                - arn:aws:elasticloadbalancing:*:{AccountId}:listener/app/mws-*
                - arn:aws:elasticloadbalancing:*:{AccountId}:targetgroup/mws-*
            - Action:
                - ec2:AuthorizeSecurityGroupIngress
                - ec2:Describe*
                - elasticloadbalancing:Describe*
              Effect: Allow
              Resource: "*"
          Version: "2012-10-17"
        PolicyName: MWSECSServiceRoleDefaultPolicyD5E258B0
        Roles:
          - Ref: MWSECSServiceRole966AC1F9
      Metadata:
        aws:cdk:path: LocationCdkStack-cdkstack/MWSECSServiceRole/DefaultPolicy/Resource
  </code></pre>
  
  <p>When I try to deploy It throws below error. </p>
  
  <pre><code>The policy failed legacy parsing (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: e54462f7-f0bc-4a8c-9ec4-9530125113ec)
  </code></pre>
  
  <p>Can someone help me to identify this issue? Any help would be appreciated. Thanks</p>