feat(core): addToRolePolicy() for custom resource provider

[jogold]

Since we only get a singleton we need a addToRolePolicy() method to
add statements when the singleton is used for multiple custom resources.

---

All Submissions:

• Have you followed the guidelines in our Contributing guide?

Adding new Unconventional Dependencies:

• This PR adds new unconventional dependencies following the process described here

New Features

• Have you added the new feature to an integration test?
  • Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[jogold]

Can be used to simplify/rewrite the following:

aws-cdk/packages/@aws-cdk/aws-cloudfront/lib/experimental/edge-function.ts

Lines 181 to 190 in 87dd2a6

	private createCrossRegionArnReader(parameterNamePrefix: string, parameterName: string, version: lambda.Version): string {
	// Prefix of the parameter ARN that applies to all EdgeFunctions.
	// This is necessary because the `CustomResourceProvider` is a singleton, and the `policyStatement`
	// must work for multiple EdgeFunctions.
	const parameterArnPrefix = this.stack.formatArn({
	service: 'ssm',
	region: EdgeFunction.EDGE_REGION,
	resource: 'parameter',
	resourceName: parameterNamePrefix + '/*',
	});

aws-cdk/packages/@aws-cdk/aws-route53/lib/record-set.ts

Lines 686 to 697 in 87dd2a6

	const provider = CustomResourceProvider.getOrCreateProvider(this, CROSS_ACCOUNT_ZONE_DELEGATION_RESOURCE_TYPE, {
	codeDirectory: path.join(__dirname, 'cross-account-zone-delegation-handler'),
	runtime: CustomResourceProviderRuntime.NODEJS_12_X,
	});
	const role = iam.Role.fromRoleArn(this, 'cross-account-zone-delegation-handler-role', provider.roleArn);
	const addToPrinciplePolicyResult = role.addToPrincipalPolicy(new iam.PolicyStatement({
	effect: iam.Effect.ALLOW,
	actions: ['sts:AssumeRole'],
	resources: [props.delegationRole.roleArn],
	}));

For this PR?

[jogold]

Needs pr-linter/exempt-integ-test

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 1f17eb7
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository