TFLint incorrectly warns about variable interpolation in JSON encoded S3 bucket policy

[loganmarchione]

TFLint version is below.

TFLint version 0.45.0
Installing `aws` plugin...
Installed `aws` (source: github.com/terraform-linters/tflint-ruleset-aws, version: 0.22.1)

I have the following TF code (with line numbers) to set a S3 bucket policy. This code works and gives me the correct effect in CloudFront/S3. No errors or warnings appear when running terraform plan.

117 # CloudFront access to S3 bucket
118 resource "aws_s3_bucket_policy" "loganmarchione_com_resources" {
119   bucket = aws_s3_bucket.loganmarchione_com_resources.id
120   policy = jsonencode({
121     "Version" : "2012-10-17",
122     "Id" : "PolicyForCloudFrontAccessToResourcesBucket",
123     "Statement" : [
124       {
125         "Sid" : "AllowCloudFrontServicePrincipal",
126         "Effect" : "Allow",
127         "Principal" : {
128           "Service" : "cloudfront.amazonaws.com"
129         },
130         "Action" : "s3:GetObject",
131         "Resource" : "${aws_s3_bucket.loganmarchione_com_resources.arn}/*",
132         "Condition" : {
133           "StringEquals" : {
134             "AWS:SourceArn" : "${aws_cloudfront_distribution.loganmarchione_com_resources.arn}"
135           }
136         }
137       }
138     ]
139   })
140 } 

When running tflint via a GitHub Action, I'm getting this error.

Run tflint
  tflint
  shell: /usr/bin/bash -e {0}
  env:
    TERRAFORM_CLI_PATH: /home/runner/work/_temp/a3044fde-6f50-44f5-b506-71df0c6c8f8d
1 issue(s) found:

Warning: Interpolation-only expressions are deprecated in Terraform v0.12.14 (terraform_deprecated_interpolation)

  on site_loganmarchione_com_resources.tf line 134:
 134:             "AWS:SourceArn" : "${aws_cloudfront_distribution.loganmarchione_com_resources.arn}"

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.2.2/docs/rules/terraform_deprecated_interpolation.md

Error: Process completed with exit code 2.

This error is incorrect, right? Because if I remove the ${ } then it literally quotes the string aws_cloudfront_distribution.loganmarchione_com_resources.arn in the bucket policy JSON.

Also, why doesn't it warn about line 131, which uses the same interpolation syntax?

[bendrucker]

Canonical HCL would be:

"AWS:SourceArn" = aws_cloudfront_distribution.loganmarchione_com_resources.arn

That : works in place of = is an interesting quirk but unimportant.

This is different because it contains a static portion as well (/*):

"${aws_s3_bucket.loganmarchione_com_resources.arn}/*"

[loganmarchione]

Yep that's it, thanks!