fix(s3,kms): use tags for granting cross-account

When a bucket or key grant targets a CDK-owned principal in another
account, the resource policy referenced the role by its ARN. S3 and KMS
validate that every principal in a resource policy exists at the time
the policy is deployed, so unless the principal's stack happens to
deploy first, the first deployment fails with "Invalid principal in
policy" (S3) or "Policy contains a statement with one or more invalid
principals" (KMS). The most common way to hit this is a cross-account +
cross-region CodePipeline: the action role lives in a support stack
with no deploy-ordering guarantee relative to the bucket/key stack, so
there is no deploy order that works on the first attempt.

ecr.Repository.grant() already solves this exact problem: when the
grantee is a CDK-owned resource in another account and the resource's
stack does not depend on the grantee's stack, tag the grantee
(aws-cdk:id) and trust the grantee's account root scoped by an
aws:PrincipalTag condition instead of the bare role ARN. Account-root
principals and condition values are not existence-checked, so deploy
order no longer matters, while the tag keeps the trust scoped to the
single intended role.

This change extracts the ECR implementation into a shared private
helper (aws-iam/lib/private/cross-account-grants.ts) and applies it to
S3 bucket grants and KMS key grants. ECR is refactored to use the
helper with no behavior change. Imported principals, same-account
grants, grants where the resource stack already depends on the principal
stack, and the KMS trustAccountIdentities are not affected.

The @aws-cdk/aws-iam:crossAccountGrantsViaPrincipalTag flag gates the S3
and KMS behavior and is off by default for existing apps. It acknowledges
that tag-scoped account-root trust survives role recreation and can be
spoofed in-account by principals allowed to tag roles.

Author: faridnsh

packages/@aws-cdk-testing/framework-integ/test/aws-kms/test/integ.key-cross-account-grant.js.snapshot/KeyCrossAccountGrantDefaultTestDeployAssert9CB4ED73.assets.json

@@ -0,0 +1,82 @@
+{
+ "Resources": {
+  "Role1ABCC5F0": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "Tags": [
+     {
+      "Key": "aws-cdk:id",
+      "Value": "KeyPrincipalStack_c85d3058e02f077dbb6fd93c359ae2c9117aa61d16"
+     }
+    ]
+   }
+  },
+  "RoleDefaultPolicy5FFB7DAB": {
+   "Type": "AWS::IAM::Policy",
+   "Properties": {
+    "PolicyDocument": {
+     "Statement": [
+      {
+       "Action": "kms:Decrypt",
+       "Effect": "Allow",
+       "Resource": "*"
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "PolicyName": "RoleDefaultPolicy5FFB7DAB",
+    "Roles": [
+     {
+      "Ref": "Role1ABCC5F0"
+     }
+    ]
+   }
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}