fix(iam): throw error when statement id is invalid (#34819)

Resolves #34819 by throwing error when PolicyStatement Statement id
contains characters not allowed by the API.

See docs in https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html

Author: camerondurham

packages/@aws-cdk-testing/framework-integ/test/aws-iam/test/integ.policy-statement-sid.ts

@@ -0,0 +1,71 @@
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as cdk from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+
+/**
+ * Integration test to verify that PolicyStatements with valid alphanumeric SIDs
+ * can be successfully deployed to AWS.
+ * 
+ * This test validates that the SID validation logic doesn't interfere with
+ * actual CloudFormation deployment of valid PolicyStatements.
+ */
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'PolicyStatementSidTest');
+
+const role = new iam.Role(stack, 'TestRole', {
+  assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+  inlinePolicies: {
+    TestPolicy: new iam.PolicyDocument({
+      statements: [
+        new iam.PolicyStatement({
+          sid: 'ValidSid123',
+          effect: iam.Effect.ALLOW,
+          actions: ['s3:GetObject'],
+          resources: ['arn:aws:s3:::example-bucket/*'],
+        }),
+        new iam.PolicyStatement({
+          sid: 'ALLCAPS',
+          effect: iam.Effect.ALLOW,
+          actions: ['s3:ListBucket'],
+          resources: ['arn:aws:s3:::example-bucket'],
+        }),
+        new iam.PolicyStatement({
+          sid: '123456',
+          effect: iam.Effect.ALLOW,
+          actions: ['logs:CreateLogGroup'],
+          resources: ['*'],
+        }),
+        new iam.PolicyStatement({
+          sid: 'abc123DEF',
+          effect: iam.Effect.ALLOW,
+          actions: ['logs:CreateLogStream'],
+          resources: ['*'],
+        }),
+        // Test statement without SID (should still work)
+        new iam.PolicyStatement({
+          effect: iam.Effect.ALLOW,
+          actions: ['logs:PutLogEvents'],
+          resources: ['*'],
+        }),
+      ],
+    }),
+  },
+});
+
+const managedPolicy = new iam.ManagedPolicy(stack, 'TestManagedPolicy', {
+  statements: [
+    new iam.PolicyStatement({
+      sid: 'ManagedPolicySid1',
+      effect: iam.Effect.ALLOW,
+      actions: ['dynamodb:GetItem'],
+      resources: ['*'],
+    }),
+  ],
+});
+
+role.addManagedPolicy(managedPolicy);
+
+new integ.IntegTest(app, 'PolicyStatementSidIntegTest', {
+  testCases: [stack],
+});

packages/@aws-cdk/aws-msk-alpha/lib/cluster.ts

@@ -631,7 +631,7 @@ export class Cluster extends ClusterBase {
       this.saslScramAuthenticationKey.addToResourcePolicy(
         new iam.PolicyStatement({
           sid:
-            'Allow access through AWS Secrets Manager for all principals in the account that are authorized to use AWS Secrets Manager',
+            'AllowAccountSecretsManagerKMSOperations',
           principals: [new iam.AnyPrincipal()],
           actions: [
             'kms:Encrypt',

packages/@aws-cdk/aws-msk-alpha/test/__snapshots__/cluster.test.ts.snap

@@ -1030,7 +1030,7 @@ exports[`MSK Cluster created with authentication enabled with combinations of sa
                 "AWS": "*",
               },
               "Resource": "*",
-              "Sid": "Allow access through AWS Secrets Manager for all principals in the account that are authorized to use AWS Secrets Manager",
+              "Sid": "AllowAccountSecretsManagerKMSOperations",
             },
           ],
           "Version": "2012-10-17",

packages/@aws-cdk/aws-msk-alpha/test/cluster.test.ts

@@ -507,7 +507,7 @@ describe('MSK Cluster', () => {
                 Effect: 'Allow',
                 Principal: { AWS: '*' },
                 Resource: '*',
-                Sid: 'Allow access through AWS Secrets Manager for all principals in the account that are authorized to use AWS Secrets Manager',
+                Sid: 'AllowAccountSecretsManagerKMSOperations',
               },
             ],
             'Version': '2012-10-17',

packages/@aws-cdk/aws-msk-alpha/test/integ.add-cluster-user.js.snapshot/ScramSecretTestStack.template.json

@@ -469,7 +469,7 @@
         "AWS": "*"
        },
        "Resource": "*",
-       "Sid": "Allow access through AWS Secrets Manager for all principals in the account that are authorized to use AWS Secrets Manager"
+       "Sid": "AllowAccountSecretsManagerKMSOperations"
       },
       {
        "Action": [

packages/@aws-cdk/aws-msk-alpha/test/integ.add-cluster-user.js.snapshot/tree.json

@@ -469,7 +469,7 @@
         "AWS": "*"
        },
        "Resource": "*",
-       "Sid": "Allow access through AWS Secrets Manager for all principals in the account that are authorized to use AWS Secrets Manager"
+       "Sid": "AllowAccountSecretsManagerKMSOperations"
       },
       {
        "Action": [

packages/@aws-cdk/aws-msk-alpha/test/integ.add-cluster-user.ts.snapshot/ScramSecretTestStack.template.json

@@ -529,7 +529,7 @@
         "AWS": "*"
        },
        "Resource": "*",
-       "Sid": "Allow access through AWS Secrets Manager for all principals in the account that are authorized to use AWS Secrets Manager"
+       "Sid": "AllowAccountSecretsManagerKMSOperations"
       }
      ],
      "Version": "2012-10-17"