Deferred ARN Policy Binding

Access-point policies fail to attach at creation because the required ARN is only known after the AccessPoint resource exists, forcing policy construction to be deferred and wrapped as an Output (string) so dependencies resolve.