Repository: cloudcomponents/cdk-constructs (language: python)

Issue:
Bug: `ApprovalRuleTemplateRepositoryAssociation` creates only one `CustomResourceProviderRole`
```
"@aws-cdk/core": "1.102.0",
"@cloudcomponents/cdk-pull-request-approval-rule": "1.35.0",
```

Bug: `ApprovalRuleTemplateRepositoryAssociation` creates only one `CustomResourceProviderRole`. while it should create one separate for each instance.

**Reproduction steps:**

I created a construct called `CodeCommitPRApprovers` that creates the approval rule template and its association:

```
export class CodeCommitPRApprovers extends Construct {
  constructor(scope: Construct, id: string, { repo }: CodeCommitPRApproversProps) {
    super(scope, id);

    // At the moment Esen will be required to approve all the pull requests.
    const userARN = User.fromUserName(this, 'user', 'user').userArn;

    const { approvalRuleTemplateName } = new ApprovalRuleTemplate(this, `${id}ApprovalRuleTemplate`, {
      approvalRuleTemplateName: `master-branch-required-approvers-for-${id}`,
      template: {
        approvers: {
          approvalPoolMembers: [userARN],
          numberOfApprovalsNeeded: 1
        },
        branches: ['master']
      }
    });

    new ApprovalRuleTemplateRepositoryAssociation(this, `${id}ApprovalRuleTemplateRepositoryAssociation`, {
      approvalRuleTemplateName,
      repository: repo,
    });
  }
}
```

Then in a stack I instantiate this construct twice, one for each repository as follows:

```
export class DevStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const infrastructureRepository = new Repository(this, 'InfrastructureRepository', {
      repositoryName: 'infrastructure',
      description: 'The CodeCommit repository for the infrastructure code.',
    });

    new CodeCommitPRApprovers(this, 'InfrastructurePRApprovers', {
      repo: infrastructureRepository
    });

    const websiteRepo = new Repository(this, 'WebRepository', {
      repositoryName: 'web',
      description: "The CodeCommit repository for the Web application code.",
    });

    new CodeCommitPRApprovers(this, 'WebsitePRApprovers', {
      repo: websiteRepo
    });
```

The generated CloudFormation template includes only one `CustomResourceProviderRole`:

```
"CustomApprovalRuleTemplateRepositoryAssociationCustomResourceProviderRoleD1B94887": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              }
            }
          ]
        },
        "ManagedPolicyArns": [
          {
            "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
          }
        ],
        "Policies": [
          {
            "PolicyName": "Inline",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "codecommit:AssociateApprovalRuleTemplateWithRepository",
                    "codecommit:DisassociateApprovalRuleTemplateFromRepository"
                  ],
                  "Resource": {
                    "Fn::GetAtt": [
                      "WebRepository0EB245C6",
                      "Arn"
                    ]
                  }
                }
              ]
            }
          }
        ]
      },
      "Metadata": {
        "aws:cdk:path": "DevStack/Custom::ApprovalRuleTemplateRepositoryAssociationCustomResourceProvider/Role"
      }
    },
```

The same `CustomResourceProviderRole` is not created for the infrastructure CodeCommit repository which means Lambda will have permissions to perform operations only to the specified Web repository.

Am I using this correctly?


Discussion / hints:

Fix patch:
diff --git a/packages/cdk-contentful-webhook/lambda-file-sizes.json b/packages/cdk-contentful-webhook/lambda-file-sizes.json
index 7bce275c3..5165ba196 100644
--- a/packages/cdk-contentful-webhook/lambda-file-sizes.json
+++ b/packages/cdk-contentful-webhook/lambda-file-sizes.json
@@ -1,1 +1,1 @@
-[{"timestamp":1620265629961,"files":[{"filename":"contentful-webhook/index.js","previous":231381,"size":231292,"diff":-89}]},{"timestamp":1615923664936,"files":[{"filename":"contentful-webhook/index.js","previous":1050356,"size":231381,"diff":-818975}]},{"timestamp":1615923376037,"files":[{"filename":"contentful-webhook/index.js","previous":1047464,"size":1050356,"diff":2892}]},{"timestamp":1615809010241,"files":[{"filename":"contentful-webhook/index.js","previous":221347,"size":1047464,"diff":826117}]},{"timestamp":1615022511778,"files":[{"filename":"contentful-webhook/index.js","previous":221344,"size":221347,"diff":3}]},{"timestamp":1609970894222,"files":[{"filename":"contentful-webhook/index.js","previous":217379,"size":221344,"diff":3965}]},{"timestamp":1609970375754,"files":[{"filename":"contentful-webhook/index.js","previous":203415,"size":217379,"diff":13964}]},{"timestamp":1607360020128,"files":[{"filename":"contentful-webhook/index.js","previous":203418,"size":203415,"diff":-3}]},{"timestamp":1600966253111,"files":[{"filename":"contentful-webhook/index.js","previous":203440,"size":203418,"diff":-22}]},{"timestamp":1599246565057,"files":[{"filename":"contentful-webhook/index.js","previous":202993,"size":203440,"diff":447}]},{"timestamp":1598552652514,"files":[{"filename":"contentful-webhook/index.js","previous":202992,"size":202993,"diff":1}]},{"timestamp":1596542526761,"files":[{"filename":"contentful-webhook/index.js","previous":207102,"size":202992,"diff":-4110}]},{"timestamp":1596540034638,"files":[{"filename":"contentful-webhook/index.js","previous":206593,"size":207102,"diff":509}]},{"timestamp":1596457456615,"files":[{"filename":"contentful-webhook/index.js","previous":206357,"size":206593,"diff":236}]},{"timestamp":1596440551356,"files":[{"filename":"contentful-webhook/index.js","previous":206424,"size":206357,"diff":-67}]},{"timestamp":1596437759972,"files":[{"filename":"contentful-webhook/index.js","previous":541950,"size":206424,"diff":-335526}]},{"timestamp":1596413723535,"files":[{"filename":"contentful-webhook/index.js","previous":542071,"size":541950,"diff":-121}]},{"timestamp":1596407623809,"files":[{"filename":"contentful-webhook/index.js","previous":191169,"size":542071,"diff":350902}]}]
+[{"timestamp":1620565790484,"files":[{"filename":"contentful-webhook/index.js","previous":231292,"size":231381,"diff":89}]},{"timestamp":1620265629961,"files":[{"filename":"contentful-webhook/index.js","previous":231381,"size":231292,"diff":-89}]},{"timestamp":1615923664936,"files":[{"filename":"contentful-webhook/index.js","previous":1050356,"size":231381,"diff":-818975}]},{"timestamp":1615923376037,"files":[{"filename":"contentful-webhook/index.js","previous":1047464,"size":1050356,"diff":2892}]},{"timestamp":1615809010241,"files":[{"filename":"contentful-webhook/index.js","previous":221347,"size":1047464,"diff":826117}]},{"timestamp":1615022511778,"files":[{"filename":"contentful-webhook/index.js","previous":221344,"size":221347,"diff":3}]},{"timestamp":1609970894222,"files":[{"filename":"contentful-webhook/index.js","previous":217379,"size":221344,"diff":3965}]},{"timestamp":1609970375754,"files":[{"filename":"contentful-webhook/index.js","previous":203415,"size":217379,"diff":13964}]},{"timestamp":1607360020128,"files":[{"filename":"contentful-webhook/index.js","previous":203418,"size":203415,"diff":-3}]},{"timestamp":1600966253111,"files":[{"filename":"contentful-webhook/index.js","previous":203440,"size":203418,"diff":-22}]},{"timestamp":1599246565057,"files":[{"filename":"contentful-webhook/index.js","previous":202993,"size":203440,"diff":447}]},{"timestamp":1598552652514,"files":[{"filename":"contentful-webhook/index.js","previous":202992,"size":202993,"diff":1}]},{"timestamp":1596542526761,"files":[{"filename":"contentful-webhook/index.js","previous":207102,"size":202992,"diff":-4110}]},{"timestamp":1596540034638,"files":[{"filename":"contentful-webhook/index.js","previous":206593,"size":207102,"diff":509}]},{"timestamp":1596457456615,"files":[{"filename":"contentful-webhook/index.js","previous":206357,"size":206593,"diff":236}]},{"timestamp":1596440551356,"files":[{"filename":"contentful-webhook/index.js","previous":206424,"size":206357,"diff":-67}]},{"timestamp":1596437759972,"files":[{"filename":"contentful-webhook/index.js","previous":541950,"size":206424,"diff":-335526}]},{"timestamp":1596413723535,"files":[{"filename":"contentful-webhook/index.js","previous":542071,"size":541950,"diff":-121}]},{"timestamp":1596407623809,"files":[{"filename":"contentful-webhook/index.js","previous":191169,"size":542071,"diff":350902}]}]
diff --git a/packages/cdk-github-webhook/lambda-file-sizes.json b/packages/cdk-github-webhook/lambda-file-sizes.json
index 852cf043c..a523a2465 100644
--- a/packages/cdk-github-webhook/lambda-file-sizes.json
+++ b/packages/cdk-github-webhook/lambda-file-sizes.json
@@ -1,1 +1,1 @@
-[{"timestamp":1620265643898,"files":[{"filename":"github-webhook/index.js","previous":191792,"size":191427,"diff":-365}]},{"timestamp":1619038419269,"files":[{"filename":"github-webhook/index.js","previous":191797,"size":191792,"diff":-5}]},{"timestamp":1617394285426,"files":[{"filename":"github-webhook/index.js","previous":191760,"size":191797,"diff":37}]},{"timestamp":1616697789259,"files":[{"filename":"github-webhook/index.js","previous":191665,"size":191760,"diff":95}]},{"timestamp":1615923673723,"files":[{"filename":"github-webhook/index.js","previous":1011459,"size":191665,"diff":-819794}]},{"timestamp":1615923385141,"files":[{"filename":"github-webhook/index.js","previous":1008634,"size":1011459,"diff":2825}]},{"timestamp":1615809019316,"files":[{"filename":"github-webhook/index.js","previous":182432,"size":1008634,"diff":826202}]},{"timestamp":1615023549795,"files":[{"filename":"github-webhook/index.js","previous":182255,"size":182432,"diff":177}]},{"timestamp":1615022566740,"files":[{"filename":"github-webhook/index.js","previous":181954,"size":182255,"diff":301}]},{"timestamp":1614104217580,"files":[{"filename":"github-webhook/index.js","previous":181904,"size":181954,"diff":50}]},{"timestamp":1612464188131,"files":[{"filename":"github-webhook/index.js","previous":181855,"size":181904,"diff":49}]},{"timestamp":1611769329263,"files":[{"filename":"github-webhook/index.js","previous":181805,"size":181855,"diff":50}]},{"timestamp":1609970949480,"files":[{"filename":"github-webhook/index.js","previous":179020,"size":181805,"diff":2785}]},{"timestamp":1607360063925,"files":[{"filename":"github-webhook/index.js","previous":178533,"size":179020,"diff":487}]},{"timestamp":1606896280100,"files":[{"filename":"github-webhook/index.js","previous":177980,"size":178533,"diff":553}]},{"timestamp":1606329557431,"files":[{"filename":"github-webhook/index.js","previous":177960,"size":177980,"diff":20}]},{"timestamp":1604259061964,"files":[{"filename":"github-webhook/index.js","previous":177961,"size":177960,"diff":-1}]},{"timestamp":1600966304194,"files":[{"filename":"github-webhook/index.js","previous":177682,"size":177961,"diff":279}]},{"timestamp":1599246609676,"files":[{"filename":"github-webhook/index.js","previous":177721,"size":177682,"diff":-39}]},{"timestamp":1596542584192,"files":[{"filename":"github-webhook/index.js","previous":181657,"size":177721,"diff":-3936}]},{"timestamp":1596540416823,"files":[{"filename":"github-webhook/index.js","previous":181110,"size":181657,"diff":547}]},{"timestamp":1596457756702,"files":[{"filename":"github-webhook/index.js","previous":181095,"size":181110,"diff":15}]},{"timestamp":1596455025723,"files":[{"filename":"github-webhook/index.js","previous":473647,"size":181095,"diff":-292552}]},{"timestamp":1596407673941,"files":[{"filename":"github-webhook/index.js","previous":332785,"size":473647,"diff":140862}]}]
+[{"timestamp":1620565795835,"files":[{"filename":"github-webhook/index.js","previous":191427,"size":191792,"diff":365}]},{"timestamp":1620265643898,"files":[{"filename":"github-webhook/index.js","previous":191792,"size":191427,"diff":-365}]},{"timestamp":1619038419269,"files":[{"filename":"github-webhook/index.js","previous":191797,"size":191792,"diff":-5}]},{"timestamp":1617394285426,"files":[{"filename":"github-webhook/index.js","previous":191760,"size":191797,"diff":37}]},{"timestamp":1616697789259,"files":[{"filename":"github-webhook/index.js","previous":191665,"size":191760,"diff":95}]},{"timestamp":1615923673723,"files":[{"filename":"github-webhook/index.js","previous":1011459,"size":191665,"diff":-819794}]},{"timestamp":1615923385141,"files":[{"filename":"github-webhook/index.js","previous":1008634,"size":1011459,"diff":2825}]},{"timestamp":1615809019316,"files":[{"filename":"github-webhook/index.js","previous":182432,"size":1008634,"diff":826202}]},{"timestamp":1615023549795,"files":[{"filename":"github-webhook/index.js","previous":182255,"size":182432,"diff":177}]},{"timestamp":1615022566740,"files":[{"filename":"github-webhook/index.js","previous":181954,"size":182255,"diff":301}]},{"timestamp":1614104217580,"files":[{"filename":"github-webhook/index.js","previous":181904,"size":181954,"diff":50}]},{"timestamp":1612464188131,"files":[{"filename":"github-webhook/index.js","previous":181855,"size":181904,"diff":49}]},{"timestamp":1611769329263,"files":[{"filename":"github-webhook/index.js","previous":181805,"size":181855,"diff":50}]},{"timestamp":1609970949480,"files":[{"filename":"github-webhook/index.js","previous":179020,"size":181805,"diff":2785}]},{"timestamp":1607360063925,"files":[{"filename":"github-webhook/index.js","previous":178533,"size":179020,"diff":487}]},{"timestamp":1606896280100,"files":[{"filename":"github-webhook/index.js","previous":177980,"size":178533,"diff":553}]},{"timestamp":1606329557431,"files":[{"filename":"github-webhook/index.js","previous":177960,"size":177980,"diff":20}]},{"timestamp":1604259061964,"files":[{"filename":"github-webhook/index.js","previous":177961,"size":177960,"diff":-1}]},{"timestamp":1600966304194,"files":[{"filename":"github-webhook/index.js","previous":177682,"size":177961,"diff":279}]},{"timestamp":1599246609676,"files":[{"filename":"github-webhook/index.js","previous":177721,"size":177682,"diff":-39}]},{"timestamp":1596542584192,"files":[{"filename":"github-webhook/index.js","previous":181657,"size":177721,"diff":-3936}]},{"timestamp":1596540416823,"files":[{"filename":"github-webhook/index.js","previous":181110,"size":181657,"diff":547}]},{"timestamp":1596457756702,"files":[{"filename":"github-webhook/index.js","previous":181095,"size":181110,"diff":15}]},{"timestamp":1596455025723,"files":[{"filename":"github-webhook/index.js","previous":473647,"size":181095,"diff":-292552}]},{"timestamp":1596407673941,"files":[{"filename":"github-webhook/index.js","previous":332785,"size":473647,"diff":140862}]}]
diff --git a/packages/cdk-pull-request-approval-rule/src/approval-rule-template-repositroy-association.ts b/packages/cdk-pull-request-approval-rule/src/approval-rule-template-repositroy-association.ts
index 73db5fe64..041da6c82 100644
--- a/packages/cdk-pull-request-approval-rule/src/approval-rule-template-repositroy-association.ts
+++ b/packages/cdk-pull-request-approval-rule/src/approval-rule-template-repositroy-association.ts
@@ -33,7 +33,7 @@ export class ApprovalRuleTemplateRepositoryAssociation extends Construct {
         {
           Effect: 'Allow',
           Action: ['codecommit:AssociateApprovalRuleTemplateWithRepository', 'codecommit:DisassociateApprovalRuleTemplateFromRepository'],
-          Resource: this.repository.repositoryArn,
+          Resource: '*',
         },
       ],
     });


Test patch:
diff --git a/packages/cdk-pull-request-approval-rule/src/__tests__/__snapshots__/approval-rule-template-repository-association.test.ts.snap b/packages/cdk-pull-request-approval-rule/src/__tests__/__snapshots__/approval-rule-template-repository-association.test.ts.snap
index 17df314bf..d2a7271b8 100644
--- a/packages/cdk-pull-request-approval-rule/src/__tests__/__snapshots__/approval-rule-template-repository-association.test.ts.snap
+++ b/packages/cdk-pull-request-approval-rule/src/__tests__/__snapshots__/approval-rule-template-repository-association.test.ts.snap
@@ -122,12 +122,7 @@ Object {
                     "codecommit:DisassociateApprovalRuleTemplateFromRepository",
                   ],
                   "Effect": "Allow",
-                  "Resource": Object {
-                    "Fn::GetAtt": Array [
-                      "Repository22E53BBD",
-                      "Arn",
-                    ],
-                  },
+                  "Resource": "*",
                 },
               ],
               "Version": "2012-10-17",
@@ -270,12 +265,7 @@ Object {
                     "codecommit:DisassociateApprovalRuleTemplateFromRepository",
                   ],
                   "Effect": "Allow",
-                  "Resource": Object {
-                    "Fn::GetAtt": Array [
-                      "Repository22E53BBD",
-                      "Arn",
-                    ],
-                  },
+                  "Resource": "*",
                 },
               ],
               "Version": "2012-10-17",