Anyone from Hashicorp -- y'all are gonna end me. Please put the best way to do things into your own docs. You have https://www.terraform.io/docs/providers/aws/d/iam_policy_doc... and can do

  data "aws_iam_policy_document" "s3_bucket" {
    version = "2012-10-17"
    statement {
      sid = "PublicReadGetObject"

      principals {
        type = "*"
        identifiers = ["*"]
      }
      actions = [
        "s3:GetObject"
      ]

      resources = [
        "arn:aws:s3:::${var.bucket_name}/*"
      ]
    }
  }

  resource "aws_s3_bucket" "s3_bucket" {
    bucket = var.bucket_name

    acl    = "public-read"

    policy = data.aws_iam_policy_document.s3_bucket.json

    website {
      index_document = "index.html"
      error_document = "error.html"
    }

    tags = var.tags
  }