Synthetics canary default role policy contains the incorrect arn syntax for a call to s3:GetBucketLocation

When using Synthetics runtime "syn-nodejs-puppeteer-3.1" the canary will try to call s3:GetBucketLocation but with an improper policy which will result in denied access.

Reproduction Steps

minimal amount of code that causes the bug (if possible) or a reference:
The current implementation on master is bugged:

        new iam.PolicyStatement({
          resources: [this.artifactsBucket.arnForObjects(`${prefix ? prefix+'/*' : '*'}`)],
          actions: ['s3:PutObject', 's3:GetBucketLocation'],
        })

What did you expect to happen?

Allow the "syn-nodejs-puppeteer-3.1" runtime to operate correctly without generating IAM access denied errors.

What actually happened?

The role will be denied access by IAM get call s3:GetBucketLocation on that S3 bucket.

Environment

• CDK CLI Version :
• Framework Version:
• Node.js Version:
• OS :
• Language (Version):

Other

Should be fixed by creating a separate policy that breaks s3:GetBucketLocation out into a separate policy that is targeted specifically at just the bucket arn:

        new iam.PolicyStatement({
          resources: [this.artifactsBucket.bucketArn],
          actions: ['s3:GetBucketLocation'],
        }),
        new iam.PolicyStatement({
          resources: [this.artifactsBucket.arnForObjects(`${prefix ? prefix+'/*' : '*'}`)],
          actions: ['s3:PutObject'],
        }),

This is 🐛 Bug Report