I created a CloudFormation stack using the template below via Boto3 Python method `cf_client.create_stack(StackName="test")`; however, when I attempt to call `s3_client.get_bucket_policy(Bucket="my-bucket")` I receive a `NoSuchBucketPolicy ... The bucket policy does not exist` error. 

```yaml
---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template

Resources:
  TestBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-bucket
      AccessControl: PublicRead
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  TestBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: TestBucket
      PolicyDocument:
        Id: TestBucketPolicy
        Statement:
          - Action:
              - "s3:GetObject"
            Effect: "Allow"
            Resource:
              Fn::Join:
                - ""
                - - "arn:aws:s3:::"
                  - Ref: TestBucket
                  - "/*"
            Principal: "*"
            Condition:
              StringLike:
                aws:Referer:
                  - "http://www.example.com/*"
                  - "http://example.com/*"
```

Is this something that's supported? 

Thanks in advance. 
mapping = list(filter(lambda m:
                m['EventSourceArn'] == source_arn and m['FunctionArn'] == aws_stack.lambda_function_arn(resource_id),
                mappings['EventSourceMappings']))
            if not mapping:
                raise Exception('ResourceNotFound')
            return mapping[0]
        elif resource_type == 'IAM::Role':
            role_name = resource_props.get('RoleName') or resource_id
            role_name = resolve_refs_recursively(stack_name, role_name, resources)
            return aws_stack.connect_to_service('iam').get_role(RoleName=role_name)['Role']
        elif resource_type == 'DynamoDB::Table':
            table_name = resource_props.get('TableName') or resource_id
            table_name = resolve_refs_recursively(stack_name, table_name, resources)
            return aws_stack.connect_to_service('dynamodb').describe_table(TableName=table_name)
        elif resource_type == 'ApiGateway::RestApi':
            apis = aws_stack.connect_to_service('apigateway').get_rest_apis()['items']
            api_name = resource_props['Name'] if resource else resource_id
            api_name = resolve_refs_recursively(stack_name, api_name, resources)
            result = list(filter(lambda api: api['name'] == api_name, apis))
            return result[0] if result else None
        elif resource_type == 'ApiGateway::Resource':
            api_id = resource_props['RestApiId'] if resource else resource_id
            api_id = resolve_refs_recursively(stack_name, api_id, resources)
            parent_id = resolve_refs_recursively(stack_name, resource_props['ParentId'], resources)
            if not api_id or not parent_id:
                return None
            api_resources = aws_stack.connect_to_service('apigateway').get_resources(restApiId=api_id)['items']
            target_resource = list(filter(lambda res:
                res.get('parentId') == parent_id and res['pathPart'] == resource_props['PathPart'], api_resources))
            if not target_resource: