Enabling S3 permissions in a terraform aws_iam_policy_document

Terraform
1

My goal is to copy the data from a set of s3 buckets into main logging account bucket. Everytime I try to perform:

aws s3 cp s3://sub-account-cloudtrail s3://master-acccount-cloudtrail --profile=admin;

I get

(AccessDenied) when calling the CopyObject operation: Access Denied`

I’ve looked at this post:

I am trying to add the bucket permissions to a terraform data aws_iam_policy_document. The statement is written like so

data aws_iam_policy_document s3 {
  version    = "2012-10-17"
  
  statement {
    sid = "CopyOobjectPermissions"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/ops-mgmt-admin"]
    }
    actions   = ["s3:GetObject","s3:PutObject","s3:PutObjectAcl"]
    resources = ["${aws_s3_bucket.nfcisbenchmark_cloudtrail.arn}/*"]
  }

  statement {
    sid = "CopyBucketPermissions"
    actions = ["s3:ListBucket"]
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/ops-mgmt-admin"]
    }
    resources = ["${aws_s3_bucket.nfcisbenchmark_cloudtrail.arn}/*"]
  }

}

My goal is to restrict the permissions to the role that is assumed from the sub-account to the master account. My specific question is what permissions need to be added in order to enable copy permissions?

Expected:
Terraform plan runs successfully

Actual:

│ Error: Error putting S3 policy: MalformedPolicy: Action does not apply to any resource(s) in statement

Any help with this would be greatly appreciated.