title: How to grant public read only access to S3 Bucket in AWS SAM template
body: <p>I am creating an S3 bucket in a SAM template and would like to give it public read access. This is what I came up with so far:</p>
  
  <pre><code>  ProductBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: !Sub ${ProductBucketName}${Stage}
  
  
    ProductBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: !Ref ProductBucket
        PolicyDocument:
          Id: PublicReadPolicy
          Version: 2012-10-17
          Statement:
            - Sid: PublicReadForGetBucketObjects
              Effect: Allow
              Principal: '*'
              Action: 's3:GetObject'
              Resource: !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref ProductBucket
  
  </code></pre>
  
  <p>This fails with a malformed exception. </p>