title: CloudFormation CloudTrail S3 Policy Error - Incorrect S3 bucket policy is detected for bucket
body: <p>Thanks in advance! </p>
  
  <p>I've been stuck on this all weekend.. I'm attempting to create a cloudtrail service in cloudformation but receive this error when ran -     Incorrect S3 bucket policy is detected for bucket: s3bucket-xxxxxx</p>
  
  <p>Here's my code; </p>
  
  <pre><code>"s3bucket-xxxxxx": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
          "AccessControl": "Private",
          "VersioningConfiguration": {
              "Status": "Suspended"
          }
      },
      "Metadata": {
          "AWS::CloudFormation::Designer": {
              "id": "XXXX"
          }
      }
  },
  "s3policytraillogs": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
          "Bucket": {
              "Ref": "s3bucket-xxxxxx"
          },
          "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Sid": "AWSCloudTrailAclCheck20150319",
                      "Effect": "Allow",
                      "Principal": {
                          "Service": "cloudtrail.amazonaws.com"
                      },
                      "Action": "s3:GetBucketAcl",
                      "Resource": "arn:aws:s3:::s3bucket-xxxxxx"
                  },
                  {
                      "Sid": "AWSCloudTrailWrite20150319",
                      "Effect": "Allow",
                      "Principal": {
                          "Service": "cloudtrail.amazonaws.com"
                      },
                      "Action": "s3:PutObject",
                      "Resource":  "arn:aws:s3:::s3bucket-xxxxxx/AWSLogs/XXXXXXXX/*",
                      "Condition": {
                          "StringEquals": {
                              "s3:x-amz-acl": "bucket-owner-full-control"
                          }
                      }
                  }
              ]
          }
      },
      "Metadata": {
          "AWS::CloudFormation::Designer": {
              "id": "XXXX"
          }
      }
  },
  "trailtraillogs": {
      "Type": "AWS::CloudTrail::Trail",
      "Properties": {
          "IncludeGlobalServiceEvents": true,
          "IsLogging": "true",
          "S3BucketName": {
              "Ref": "s3bucket-xxxxxx"
          }
      },
      "Metadata": {
          "AWS::CloudFormation::Designer": {
              "id": "XXXX"
          }
      }
  }
  </code></pre>