I created a CloudFormation stack using the template below via Boto3 Python method `cf_client.create_stack(StackName="test")`; however, when I attempt to call `s3_client.get_bucket_policy(Bucket="my-bucket")` I receive a `NoSuchBucketPolicy ... The bucket policy does not exist` error. 

```yaml
---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template

Resources:
  TestBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-bucket
      AccessControl: PublicRead
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  TestBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: TestBucket
      PolicyDocument:
        Id: TestBucketPolicy
        Statement:
          - Action:
              - "s3:GetObject"
            Effect: "Allow"
            Resource:
              Fn::Join:
                - ""
                - - "arn:aws:s3:::"
                  - Ref: TestBucket
                  - "/*"
            Principal: "*"
            Condition:
              StringLike:
                aws:Referer:
                  - "http://www.example.com/*"
                  - "http://example.com/*"
```

Is this something that's supported? 

Thanks in advance. 
LOG.debug('Extract resource attribute: %s %s' % (resource_type, attribute))
    
    if resource_type == 'Lambda::Function':
        actual_attribute = 'FunctionArn' if attribute == 'Arn' else attribute
        return resource['Configuration'][actual_attribute]
    elif resource_type == 'DynamoDB::Table':
        actual_attribute = 'LatestStreamArn' if attribute == 'StreamArn' else attribute
        value = resource['Table'].get(actual_attribute)
        return value
    elif resource_type == 'ApiGateway::RestApi':
        if attribute == 'PhysicalResourceId':
            return resource['id']
        if attribute == 'RootResourceId':
            resources = aws_stack.connect_to_service('apigateway').get_resources(restApiId=resource['id'])['items']
            for res in resources:
                if res['path'] == '/' and not res.get('parentId'):
                    return res['id']
    elif resource_type == 'ApiGateway::Resource':
        if attribute == 'PhysicalResourceId':
            return resource['id']
    attribute_lower = common.first_char_to_lower(attribute)
    return resource.get(attribute) or resource.get(attribute_lower)
def resolve_ref(stack_name, ref, resources, attribute):
    if ref == 'AWS::Region':
        return aws_stack.get_region()
    if ref == 'AWS::Partition':
        return 'aws'
    if ref == 'AWS::StackName':
        return stack_name