fix(bedrock-alpha): apply permission dependency to existing and non-existing roles

[mellevanderlinde]

Issue # (if applicable)

Closes #35120

Reason for this change

Dependency on permission was only applied to new roles, not to existing roles.

Description of changes

The dependency on permission now applies to both new and existing roles.

Describe any new or updated permissions being added

Not applicable.

Description of how you validated changes

I've added an integration test for an agent with an existing/custom role attached to it.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[pahud]

Thank you for the PR!

Consider to add a unit test that explicitly verifies grant.applyBefore() is called for existing roles:

   test('applies dependency for existing role', () => {
     const existingRole = new iam.Role(stack, 'ExistingRole', {
       assumedBy: new iam.ServicePrincipal('bedrock.amazonaws.com'),
     });

     new Agent(stack, 'Agent', {
       instruction: 'test',
       foundationModel: BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V2_0,
       existingRole,
     });

     // Verify CloudFormation template has DependsOn
     const template = Template.fromStack(stack);
     template.hasResource('AWS::Bedrock::Agent', {
       DependsOn: [Match.stringLikeRegexp('.*DefaultPolicy.*')]
     });
   });

[mellevanderlinde]

@pahud That was indeed missing, I've added a test for existing roles and roles created by the Agent construct

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: de431d1
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[pahud]

LGTM! Thanks!