Crossplane won't create an IAM policy because it sees an unpatched 'document' attribute.

[nl-brett-stime]

What happened?

Defined an IAM Policy with a patched document attribute. Crossplane won't create the policy because it sees the unpatched spec.forProvider which expects the document attribute to be defined via patching:

defined/compositeresourcedefinition.apiextensions.crossplane.io
cannot render composed resource from resource template ...
cannot use dry-run create to name composed resource: Policy.iam.aws.crossplane.io ...
is invalid: spec.forProvider.document: Required value

Also, encountered by others who filed an issue in the crossplane/crossplane repo:
crossplane/crossplane#3009

How can we reproduce it?

Composition snippet:

  resources:
    - name: myPolicy
      base:
        apiVersion: iam.aws.crossplane.io/v1beta1
        kind: Policy
        metadata:
          annotations: { }
          name: my-policy
        spec:
          forProvider:
            name: my-policy
        patches:
          - type: CombineFromComposite
            combine:
              strategy: string
              string:
                fmt: |
                  {
                    "Version": "2012-10-17",
                    "Statement": [
                      {
                        "Sid": "VisualEditor0",
                        "Effect": "Allow",
                        "Action": [
                          "secretsmanager:GetSecretValue",
                          "secretsmanager:DescribeSecret",
                          "secretsmanager:UpdateSecretVersionStage",
                          "secretsmanager:PutSecretValue"
                        ],
                        "Resource": "%s"
                      }
                    ]
                  }
              variables:
                - fromFieldPath: spec.sManagerSecretArn

What environment did it happen in?

Crossplane version: 1.12

OpenShift.

[nl-brett-stime]

Sorry. It was bad indentation levels (almost like YAML isn't a great format for complex documents like these 🤷‍♂️ ).
For anyone who follows, patches should be on the same level as base. It should not be at the same level as spec.