title: How to add OriginAccessIdentity to AWS S3 Bucket Policy using troposphere
body: <p>I have a AWS Cloudformation stack, created in Python using Troposphere. I need to add OriginAccessIdentity to the S3 bucket access policy.</p>
  
  <p>Amongst other things, I am importing the following:</p>
  
  <pre class="lang-py prettyprint-override"><code>from awacs.aws import (
      Allow,
      Policy,
      AWSPrincipal,
      Statement
  )
  </code></pre>
  
  <p>Part of the stack creates a Cloudfront distribution, added a S3 Origin with just one associated cacheBehavior. This works fine, the Origin an behavior are created and can be seen in the AWS Cloudfront console.</p>
  
  <p>I have used the following code to create an OriginAccessIdentity:</p>
  
  <pre class="lang-py prettyprint-override"><code>cloudfrontOriginAccessIdentity = t.add_resource(CloudFrontOriginAccessIdentity(
     "cloudfrontOriginAccessIdentity",
        CloudFrontOriginAccessIdentityConfig=CloudFrontOriginAccessIdentityConfig(
          Comment = "React-Pattern-Origin-Access-Identity" 
        )
   ))
  </code></pre>
  
  <p>Again, this works fine and the OriginAccessIdentity is created and can be seen in the AWS Cloudfront console, and is associated with the Origin.</p>
  
  <p>I am using the following code to create a S3BucketPolicy:</p>
  
  <pre class="lang-py prettyprint-override"><code>t.add_resource(s3.BucketPolicy(
    "reactBucketPolicy",
      Bucket=Ref("ParamS3BucketName"),
      PolicyDocument=dict(
        Statement=[dict(
          Sid="reactBucketPolicyStatement01",
          Effect="Allow",
          Action=[
            "s3:GetObject"
          ],
          Principal=AWSPrincipal(["*"]),
          Resource=[Join("", ["arn:aws:s3:::", Ref("ParamS3BucketName"), "/*"])],
        )],
      )
  )) 
  </code></pre>
  
  <p>This too works fine, with the policy being generated and attached to the bucket - can be seen in the AWS S3 console.
  The issue I am having is trying to replace<br>
  <code>Principal=AWSPrincipal(["*"])</code><br>
  with<br>
  <code>Principal=AWSPrincipal([&lt;the_origin_access_identity&gt;])</code></p>
  
  <p>I have tried<br>
  <code>Principal=AWSPrincipal([Join("", ["origin-access-identity/cloudfront/", "Ref(cloudfrontoriginaccessidentity)"])])</code><br>
  and<br>
  <code>Principal=AWSPrincipal([Ref(cloudfrontoriginaccessidentity)])</code></p>
  
  <p>but Cloudformation rejects the update, saying that the Principal is invalid.
  What do I need to replace the <code>*</code> with in order to get Cloudformation to add my <code>OriginAccessIdentity</code> as the principal to the policy?</p>