fix(iam): ManagedPolicy can again be granted actions on resources

[QuantumNeuralCoder]

Closes #32795.

Reason for this change

Before this change, ManagedPolicy explicitly throw and error for statements like following for TableV2. This was supported in v2.131.

    const table = TableV2.fromTableArn(
      this,
      'Table',
      arnForTable,
    );
    table.grantReadWriteData(policy);

Description of changes

What code changes did you make?

policyFragment

now returns and empty PrincipalPolicyFragment. This enables the user to attach actions to policies. The generated CFN template will now contain the required actions, effects and resources blocks. It will still require the app to attach this policy to a Principal, user or role for it to work.

Have you made any important design decisions?
See above.

What AWS use cases does this change enable? To enable the use cases, which AWS service features are utilized?
Restores parity with a feature until 2.131 which allowed CDK apps to grant actions on resources to generate Policy Fragments for managed resources.

Describe any new or updated permissions being added

None

Description of how you validated changes

Yes to Both.
Integration test has been majorly refactored to do deployment checks as well in addition to the CFN checks.

Checklist

• [ x] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ The first word of the pull request title should not be capitalized. If the title starts with a CDK construct, it should be in backticks "``".

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: fde135a
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository