如何在AWS SAM模板中授予对S3存储桶的公共只读访问权限

Question

我正在SAM模板中创建一个S3存储桶，并希望对其进行公共读取访问。到目前为止，这是我想出的：

  ProductBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ProductBucketName}${Stage}


  ProductBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ProductBucket
      PolicyDocument:
        Id: PublicReadPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref ProductBucket

此操作失败，并带有格式错误的异常。