Pulumi has a special type called Output that's made for managing resource relationships like these. Tension: the ARN won't be available until after the `AccessPoint` is created. Outcome: you'll need to construct the policy as a string output.

ad4a7d06-ff0a-4f1c-b660-c30f00af069d