Invalid character '%!'(MISSING) on policy in composition

[zapr-16]

What happened?

After upgrading provider-aws from 0.39.0 to 0.41.0, policies defined in my composite resources started failing with the error below. The error goes away after rolling back to 0.39.0

2023-06-23T15:45:13.359Z DEBUG events	
cannot check if policy is up to date: invalid character '%!'(MISSING) looking for beginning of value	
{
  "type": "Warning", 
  "object": 
     {
       "kind":"Policy",
       "name":"policies-aws-secrets-manager",
       "uid":"8e5e38c4-506e-412a-b05e-733cb9137eac",
       "apiVersion":"iam.aws.crossplane.io/v1beta1",
       "resourceVersion":"3054451"
      }, 
       "reason": "CannotObserveExternalResource"
 }

This is a sample failing resource:

- name: Secretsmanager-Policy
      base:
        apiVersion: iam.aws.crossplane.io/v1beta1
        kind: Policy
        metadata:
          labels:
            role: aws-secrets-manager
        spec:
          deletionPolicy: Orphan
          forProvider:
            name: AllowSealedSecretsMasterKeyRead
            document: ""
      patches:
        - fromFieldPath: spec.id
          toFieldPath: metadata.name
          transforms:
            - type: string
              string:
                fmt: "%s-aws-secrets-manager"
        - fromFieldPath: spec.provider
          toFieldPath: spec.providerConfigRef.name
        - fromFieldPath: spec.account
          toFieldPath: metadata.annotations[crossplane.io/external-name]
          transforms:
            - type: string
              string:
                fmt: "arn:aws:iam::%s:policy/AllowSealedSecretsMasterKeyRead"
        - type: CombineFromComposite
          combine:
            variables:
              - fromFieldPath: spec.account
            strategy: string
            string:
              fmt: |
                {
                  "Version": "2012-10-17",
                  "Statement": [
                      {
                          "Effect": "Allow",
                          "Action": [
                              "secretsmanager:GetResourcePolicy",
                              "secretsmanager:GetSecretValue",
                              "secretsmanager:DescribeSecret",
                              "secretsmanager:ListSecretVersionIds"
                          ],
                          "Resource": [
                              "arn:aws:secretsmanager:eu-central-1:%s:secret:sealed-secrets-master*"
                          ]
                      }
                  ]
                }
          toFieldPath: spec.forProvider.document

How can we reproduce it?

Install provider-aws v0.41.0
Try to have a composite resource containing a similar policy to the one above

What environment did it happen in?

Crossplane version: 12.2.2
Provider-aws version: 0.41.0
K8s version. 1.27.3
K8s distro: EKS

[MisterMX]

Should be fixed in #1790. Please checkout v0.41.1.

[MisterMX]

Closing, as decoding errors are fixed in v0.41.1 and v0.42.0.