I created a CloudFormation stack using the template below via Boto3 Python method `cf_client.create_stack(StackName="test")`; however, when I attempt to call `s3_client.get_bucket_policy(Bucket="my-bucket")` I receive a `NoSuchBucketPolicy ... The bucket policy does not exist` error. 

```yaml
---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template

Resources:
  TestBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-bucket
      AccessControl: PublicRead
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  TestBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: TestBucket
      PolicyDocument:
        Id: TestBucketPolicy
        Statement:
          - Action:
              - "s3:GetObject"
            Effect: "Allow"
            Resource:
              Fn::Join:
                - ""
                - - "arn:aws:s3:::"
                  - Ref: TestBucket
                  - "/*"
            Principal: "*"
            Condition:
              StringLike:
                aws:Referer:
                  - "http://www.example.com/*"
                  - "http://example.com/*"
```

Is this something that's supported? 

Thanks in advance. 
return ''
            
            container_name = self.get_container_name(func_arn)
            docker_cmd = self._docker_cmd()
            
            LOG.debug('Getting container network: %s' % container_name)
            cmd = (
                '%s inspect %s'
                ' --format "{{ .HostConfig.NetworkMode }}"'
            ) % (docker_cmd, container_name)
            LOG.debug(cmd)
            cmd_result = run(cmd, asynchronous=False, stderr=subprocess.PIPE, outfile=subprocess.PIPE)
            container_network = cmd_result.strip()
            return container_network
    def idle_container_destroyer(self):
        """
        Iterates though all the lambda containers and destroys any container that has
        been inactive for longer than MAX_CONTAINER_IDLE_TIME_MS.
        :return: None
        """
        LOG.info('Checking if there are idle containers.')
        current_time = int(time.time() * 1000)
        for func_arn, last_run_time in dict(self.function_invoke_times).items():
            duration = current_time - last_run_time
            
            if duration < MAX_CONTAINER_IDLE_TIME_MS:
                continue
            
            self.destroy_docker_container(func_arn)
    def start_idle_container_destroyer_interval(self):