How to grant public read only access to S3 Bucket in AWS SAM template

I am creating an S3 bucket in a SAM template and would like to give it public read access. This is what I came up with so far:

  ProductBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ProductBucketName}${Stage}


  ProductBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ProductBucket
      PolicyDocument:
        Id: PublicReadPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref ProductBucket

This fails with a malformed exception.

Your template is fine except the line that says - - 'arn:aws:s3:::' where its malformed. Just a suggestion that you can use Fn::Sub over Fn::Join when delimiter is an empty string.

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  ProductBucketName:
    Type: String

Resources:
  ProductBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ProductBucketName}-${AWS::StackName}


  ProductBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ProductBucket
      PolicyDocument:
        Id: PublicReadPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Sub arn:aws:s3:::${ProductBucket}/*

Hope this help you move forward.

I found the AWS documentation's yaml example to look a bit funny, but I followed it and gave my CF stack IAM s3:PutBucketPolicy permissions, and it worked. Below is my SAM.

  ExampleBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub <bucket-name>

  ExampleBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: "ExampleBucket"
      PolicyDocument:
        Statement:
          - Action:
              - "s3:GetObject"
            Effect: "Allow"
            Resource:
              Fn::Join:
                - ""
                - - "arn:aws:s3:::"
                  - Ref: "ExampleBucket"
                  - "/*"
            Principal: "*"

Here is the AWS documentation page you've probably already consulted: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html.