Repository: aws-cloudformation/cfn-lint

Issue:
E3002, E3031 & E3512 for Policy statement with Assumed-role session principals
### CloudFormation Lint Version

1.10.1

### What operating system are you using?

Mac

### Describe the bug

When I use Assumed-role session principals inside Policy statements, I get multiple false positives:

```
E3002 '*' was expected
test-cfn.yml:11:15

E3031 'arn:aws:sts::1234:assumed-role/rolename/rolesessionname' does not match '^\\d{12}$'
test-cfn.yml:11:15

E3031 'arn:aws:sts::1234:assumed-role/rolename/rolesessionname' does not match '^arn:(aws|aws-cn|aws-us-gov):iam::\\d{12}:(?:root|user|group|role)'
test-cfn.yml:11:15

E3031 'arn:aws:sts::1234:assumed-role/rolename/rolesessionname' does not match '^arn:(aws|aws-cn|aws-us-gov):iam::cloudfront:user/.+$'
test-cfn.yml:11:15

E3512 'arn:aws:sts::1234:assumed-role/rolename/rolesessionname' is not valid under any of the given schemas
test-cfn.yml:11:15
```

### Expected behavior

Assumed-role session principals should be supported too as described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-sessions

Format seems to be: `arn:aws:sts::<AWS-account-ID>:assumed-role/<role-name>/<role-session-name>`

### Reproduction template

```yaml
Resources:
  TestBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: 'bucket'
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: 'test-sid'
            Principal:
              AWS: 'arn:aws:sts::1234:assumed-role/rolename/rolesessionname'
            Action: 's3:ListBucket'
            Effect: Allow
            Resource:
              - 'arn:aws:s3:::bucket'
```


Discussion:

Patch:
diff --git a/src/cfnlint/data/schemas/other/iam/policy.json b/src/cfnlint/data/schemas/other/iam/policy.json
index ecfec194ea..0bbe33bed9 100644
--- a/src/cfnlint/data/schemas/other/iam/policy.json
+++ b/src/cfnlint/data/schemas/other/iam/policy.json
@@ -28,6 +28,9 @@
     {
      "pattern": "^arn:(aws|aws-cn|aws-us-gov):iam::\\d{12}:(?:root|user|group|role)"
     },
+    {
+     "pattern": "^arn:(aws|aws-cn|aws-us-gov):sts::\\d{12}:assumed-role"
+    },
     {
      "pattern": "^arn:(aws|aws-cn|aws-us-gov):iam::cloudfront:user/.+$"
     }


Test patch:
diff --git a/test/unit/rules/resources/iam/test_resource_policy.py b/test/unit/rules/resources/iam/test_resource_policy.py
index b56635507e..1a7ea216ae 100644
--- a/test/unit/rules/resources/iam/test_resource_policy.py
+++ b/test/unit/rules/resources/iam/test_resource_policy.py
@@ -224,3 +224,29 @@ def test_principal_wildcard(self):
             )
         )
         self.assertListEqual(errs, [])
+
+    def test_assumed_role(self):
+        validator = CfnTemplateValidator({}).evolve(
+            context=Context(functions=FUNCTIONS)
+        )
+
+        policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Allow",
+                    "Action": "*",
+                    "Resource": "arn:aws:s3:::bucket",
+                    "Principal": {
+                        "AWS": "arn:aws:sts::123456789012:assumed-role/rolename/rolesessionname"
+                    },
+                },
+            ],
+        }
+
+        errs = list(
+            self.rule.validate(
+                validator=validator, policy=policy, schema={}, policy_type=None
+            )
+        )
+        self.assertListEqual(errs, [])