Minimal CF template which creates a lambda fn & associates with a bucket, but fails

gistfile1.txt

---
AWSTemplateFormatVersion: 2010-09-09
Description: Calligre Lambda CF Stack
Resources:
  ImagePendingResizeBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      NotificationConfiguration:
        LambdaConfigurations:
          - Function: !GetAtt ResizeLambda.Arn
            Event: "s3:ObjectCreated:*"
  ResizeLambda:
    Type: "AWS::Lambda::Function"
    Properties:
      Code:
        S3Bucket: calligre-us-east-2
        S3Key: resize.zip
      Description: Lambda to resize images
      Handler: ResizeImage.handler
      MemorySize: 512
      Role: !GetAtt LambdaS3IamRole.Arn
      Runtime: python2.7
      Timeout: 10
  LambdaS3IamRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
  LambdaS3IamPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: LambdaS3Role
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: 
            - "s3:GetObject"
            - "s3:GetObjectAcl"
            Resource: "arn:aws:s3:::*"
          - Effect: "Allow"
            Action: 
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:PutLogEvents"
            Resource: "*"
      Roles:
        - Ref: LambdaS3IamRole
  LambdaS3InvokePermission: 
    Type: "AWS::Lambda::Permission"
    Properties: 
      FunctionName: !GetAtt ResizeLambda.Arn
      Action: "lambda:InvokeFunction"
      Principal: "s3.amazonaws.com"
      SourceAccount: 
        Ref: "AWS::AccountId"
      SourceArn: 
        Fn::Join: ["", ["arn:aws:s3:::", !Ref ImagePendingResizeBucket]]