title: Terraform AWS bucket policy document, ARN gets changed
body: <p>I'm having a strange issue where ARNs get changed at some point.  This is happening for both a bucket policy and KMS key policy.</p>
  <p>In the policy document, I specify Role ARNs in an external account:</p>
  <pre><code>...
  principals {
    type        = &quot;AWS&quot;
    identifiers = var.list_of_arns
  }
  ...
  </code></pre>
  <p>The terraform plan output looks normal:</p>
  <pre><code>Principal = {
    AWS = [
      &quot;arn:aws:iam::account-id:role/role1&quot;,
      &quot;arn:aws:iam::account-id:role/role2&quot;,
    ]
  }
  </code></pre>
  <p>However, the actual resources that get created are different.</p>
  <pre><code>{
    &quot;Statement&quot;: [
    ...
    &quot;Principal&quot;: {
      &quot;AWS&quot;: [
        &quot;SOMESTRINGOF21CHARS&quot;,
        &quot;OTHERSTRINGOF21CHARS&quot;
      ]
    }
    ..
  }
  </code></pre>
  <p>Why is this happening?</p>
  <p>Thanks</p>