@Frank @Jay any suggestions for doing new iam.*PolicyStatement*({ in typescript? When I follow the guide and try the following:

auth.attachPermissionsForAuthUsers([
    // Allow access to the API
    api,
    // Policy granting access to a specific folder in the bucket
    new iam.PolicyStatement({
      actions: ['s3:*'],
      effect: iam.Effect.ALLOW,
      resources: [
        bucket.bucketArn + '/private/${<http://cognito-identity.amazonaws.com:sub|cognito-identity.amazonaws.com:sub>}/*',
      ],
    }),
  ]);

I get the following error:

Type 'PolicyStatement' is not assignable to type 'string | Omit<string, SupportedPermissions> | IConstruct | [IConstruct, string] | PolicyStatement'.
  Type 'PolicyStatement' is missing the following properties from type 'PolicyStatement': action, notAction, principal, notPrincipal, and 3 more.ts(2322)

Errors like this are almost always having the wrong version of the Cdk installed to match SST.

Interesting @Derek Kershner, I am running the following:

"@serverless-stack/cli": "^1.2.22",
    "@serverless-stack/resources": "^1.2.22",
    "@tsconfig/node16": "^1.0.3",
    "@types/aws-lambda": "^8.10.70",
    "@types/node": "^17.0.42",
    "aws-cdk-lib": "^2.27.0",

Thanks @Derek Kershner, just tried it, the PolicyStatement code passes, but, there is still an error at

IdentityPoolId: auth.cognitoIdentityPoolId,

The error is:

(property) IdentityPoolId: string | undefined
Type 'string | undefined' is not assignable to type 'string | CfnOutputProps'.
  Type 'undefined' is not assignable to type 'string | CfnOutputProps'.ts(2322)

Changing it to the following passes:

IdentityPoolId: auth.cognitoIdentityPoolId || {
      description: '',
      value: '',
    },

But, I have no idea whether that is valid.

Resolved in https://serverless-stack.slack.com/archives/C01JG3B20RY/p1655214031948789?thread_ts=1655211184.077929&cid=C01JG3B20RY