How to ensure ApiGateway CloudWatch logging Role no matter what other Stacks do?

[VaidotasSm]

Related to - #10878 - [ApiGateway] RestApi updates account level role used for ApiGateway CloudWatch logging #10878

It has lots of information and is supposedly fixed already, but neither on that issue nor in documentation I could find hints of what is proper setup for following:

• One account, one region, multiple API Gateway APIs.
• Multiple independent CDK Stacks that know nothing about each other.
• How to deploy your API Gateway API in a way that no matter what other Stacks would do (deployed, destroyed...), CloudWatch logging would always work.

Is this the best that can be done?

• If I use same role name in all Stacks - will get role already exists in stack.
• If I use different role name for each stack - each deployment will override global CloudWatch log role ARN - which does not sound as a good thing. Although role.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN) seems to make it work in the end. But doesn't look as solid solution.

const api = new cdk.aws_apigateway.LambdaRestApi(scope, 'test-api', {
  ...
  cloudWatchRole: false,
});

const role = new cdk.aws_iam.Role(scope, 'cloud-watch-role', {
  roleName: 'cloud-watch-role',
  assumedBy: new cdk.aws_iam.ServicePrincipal('apigateway.amazonaws.com'),
  managedPolicies: [
    cdk.aws_iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AmazonAPIGatewayPushToCloudWatchLogs'),
  ],
});
role.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);

const cloudWatchAccount = new cdk.aws_apigateway.CfnAccount(scope, 'global-cfn-account', {
  cloudWatchRoleArn: role.roleArn,
});
cloudWatchAccount.node.addDependency(api);