diff --git a/website/source/docs/providers/aws/r/cloudfront_origin_access_identity.html.markdown b/website/source/docs/providers/aws/r/cloudfront_origin_access_identity.html.markdown
index 6e023a931..863748b3a 100644
--- a/website/source/docs/providers/aws/r/cloudfront_origin_access_identity.html.markdown
+++ b/website/source/docs/providers/aws/r/cloudfront_origin_access_identity.html.markdown
@@ -93,7 +93,7 @@ data "aws_iam_policy_document" "s3_policy" {
 
 aws_s3_bucket "bucket" {
   ...
-  policy = "${data.aws_iam_policy_document.s3_policy}"
+  policy = "${data.aws_iam_policy_document.s3_policy.json}"
 }
 ```
 
@@ -109,4 +109,4 @@ Cloudfront Origin Access Identities can be imported using the `id`, e.g.
 
 ```
 $ terraform import aws_cloudfront_origin_access_identity.origin_access E74FTE3AEXAMPLE
-```
\ No newline at end of file
+```