Cloudformation - Specifying S3 ACL Principal

Hi,

I am trying to specify a principal inside of an S3 ACL policy by using Fn:GetAtt but keep on getting "invalid bucket policy syntax". Below is the excerpt, what am I doing wrong?

 "ingestions3bucketbucketpolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "ingestions3bucket"
        },
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "s3:PutObject"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:s3:::",
                    {
                      "Ref": "ingestions3bucket"
                    },
                    "/*"
                  ]
                ]
              },
              "Principal": {
                "Fn::Join": [
                  "",
                  [
                    "\"AWS\": ",
                    {
                      "Fn::GetAtt": [
                        "IngestionServiceRole",
                        "Arn"
                      ]
                    }
                  ]
                ]
              }
            }
          ]
        }
      },
      "DependsOn": "IngestionServiceRole"
    }