bug: E3019 error message has an unhelpful error message, at least for S3::BucketPolicy

[rix0rrr]

Bug summary

The error message seems to indicate that we are creating multiple resources with the same physical ID. While that's true indirectly, a resource like S3::BucketPolicy is only REFERENCING another resource, not creating it.

Version or commit

1.8.0-beta

Affected interface

Node.js / WASM

Environment

No response

Validation engine

None

Minimal CloudFormation template

{
 "Resources": {
  "CfnBucket": {
   "Type": "AWS::S3::Bucket"
  },
  "CfnBucketFromCfnBucketPolicyFA8F254C": {
   "Type": "AWS::S3::BucketPolicy",
   "Properties": {
    "Bucket": {
     "Ref": "CfnBucket"
    },
    "PolicyDocument": { }
   }
  },
  "CfnBucketPolicy": {
   "Type": "AWS::S3::BucketPolicy",
   "Properties": {
    "Bucket": {
     "Ref": "CfnBucket"
    },
    "PolicyDocument": { }
   }
  }
 }
}

Reproduction details

The error message is:

Bucket: Primary identifiers {'Bucket': 'Ref("CfnBucket")'} should have unique values across the resources {'CfnBucketFromCfnBucketPolicyFA8F254C', 'CfnBucketPolicy'} (CloudFormation Validate)

The error seems to be: there cannot be two BucketPolicy resources for the same bucket, because one Policy would overwrite the other. "Should have unique values" seems to allow too much: if I gave one the value A and the other B, would it be fine? (No, because the buckets A and B would not exist).

So the rule is signaling something significant, but not labeling it in a way that is helpful to a user.

A description like

There should be at most one AWS::S3::BucketPolicy per AWS::S3::Bucket

Would be better.

Additional context

No response