refactor(events-targets): replace custom resource with native grantWrite method for log group write permissions

[frankpengau]

Issue # (if applicable)

Closes #20855

Reason for this change

The custom resource lambda used to just add the log group resource policy seems like an unnecessary use of the lambda resource. It would be better to refactor it to use the native grantWrite method for CloudWatch Log Group to grant the write permissions necessary for eventbridge.

Description of changes

Remove custom cloudwatch log group rule target custom resource lambda to add write permissions and replace with grantWrite.

Similar to how sqs grants write permissions for eventbridge:

aws-cdk/packages/aws-cdk-lib/aws-events-targets/lib/sqs.ts

Line 72 in efbe6de

this.queue.grantSendMessages(new iam.ServicePrincipal('events.amazonaws.com', { conditions }));

Description of how you validated changes

Changed unit test, but might need some help to get the integration test to work

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 6c9e13b
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[TheRealAmazonKendra]

This was used because a ResourcePolicy is needed here, which is what the grant function is creating under the hood. When this was first written, that resource wasn't available in all regions so we used a Custom Resource.

Unfortunately, providing a migration path to not using said custom resource isn't completely straight forward due to the onDelete function added here and because there is a limit of 10 resource policies allowed per region/account. If we try to add a new policy to perform a replacement, it might cause users to hit that limit and then the deployment will fail.

I'm actually working on this same issue for another package right now.

[aws-cdk-automation]

This PR has been in the BUILD FAILING state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

[frankpengau]

@TheRealAmazonKendra If you're working on this in another package and are able to also add in this package as well, that would be great! 🙏

Happy to close this PR off for now and wait for your changes to fix it for good.

[aws-cdk-automation]

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.