opened
rix0rrr
username_0
Immutably imported `Role`s could not be used for CodeBuild
`Project`s, because they would create a policy but be unable
to attach it to the Role. That leaves an unattached Policy,
which is invalid.

Fix this by making `Policy` objects only render to an `AWS::IAM::Policy`
resource if they actually have any effect. It is perfectly allowed to
create new unattached Policy objects, or have empty Policy objects.
Only if and when they actually need to mutate the policy of an IAM
identity will they render themselves to the CloudFormation template.
Being able to abstract away these kinds of concerns is exactly the value
of a higher-level programming model.

To allow for the rare cases where an empty Policy object would be
considered a programming error, we still have the flag `mustCreate`
which triggers the legacy behavior of alwyas creating the
`AWS::IAM::Policy` resource which must have a statement and be
attached to an identity.



----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

<!-- 
Please read the contribution guidelines and follow the pull-request checklist:
https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md
 -->
fix(codebuild): cannot use immutable roles for Project
issue