Policy document should not specify a principal - terraform aws_iam_policy_document

Question

I have a an IAM policy which I have created and it seems to keep complaining that the policy document should not specify a principal. Am really unsure of what is wrong with my policy. This policy will be attached to my S3 Bucket which specifies only a certain group is allowed to do the following actions GetObject and ListBucket.

Error : MalformedPolicyDocument: Policy document should not specify a principal

My IAM Policy is as follows :

data "aws_iam_policy_document" "s3_admin_access" {
  statement {
    sid    = "AllowGroupAAccess"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:ListBucket"
    ]
  
  resources = local.s3_etl_bucket_array
  
  principals {
    type        = "AWS"
    identifiers = [aws_iam_group.iam_group_team["admin-team"].arn]
  }
 }

 statement {
  sid    = "DenyAllOtherUsers"
  effect = "Deny"
  actions = [
    "s3:*"
  ]

  resources = local.s3_etl_bucket_array

  principals {
    type        = "AWS"
    identifiers = ["*"]
  }

  condition {
    test     = "StringNotEquals"
    variable = "aws:PrincipalArn"
    values   = [aws_iam_group.iam_group_team["admin-team"].arn]
  }
 }
}

resource "aws_iam_policy" "s3_admin_access" {
  name   = "${local.csi}-s3_admin_access"
  path   = "/"
  policy = data.aws_iam_policy_document.s3_admin_access.json
}

Answer 1

The short answer is that groups cannot be used as a principal in a resource policy and the bucket policy is a type of resource policy [1]:

You cannot identify a user group as a principal in a policy (such as a resource-based policy) because groups relate to permissions, not authentication, and principals are authenticated IAM entities.

---

[1] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying