[codebuild] Codebuild Project in VPC creates policy incompatible with GovCloud

[michaelfedell]

Reproduction Steps

When attempting to create a CodeBuild project within a VPC in a GovCloud account, the DefaultPolicy attached to CodeBuild IAM Role uses a resource reference with arn:aws:ec2:... instead of arn:${Aws.PARTITION}:ec2:...

e.g.:

What did you expect to happen?

A policy should have been added for resource "arn:aws:ec2:us-gov-west-1:[ACCOUNT_NUMBER]:network-interface/*". Region us-gov-west-1 is pulled from env, as should Partition aws-gov.

What actually happened?

Aws.PARTITION is not sourced, instead :aws: is used as the partition when constructing the url
Can be seen here

Environment

• CLI Version : 1.65.0
• Framework Version: 1.65.0
• Node.js Version: 12.14.1
• OS : MacOS 10.15.6
• Language (Version): all

Other

10:30:14 AM | UPDATE_FAILED        | AWS::IAM::Policy            | CodebuildRoleDefaultPolicy98E55375
Partition "aws" is not valid for resource "arn:aws:ec2:us-gov-west-1:[ACCOUNT_NUMBER]:network-interface/*". (Service: AmazonIdentityManagement; Status Code: 400;
Error Code: MalformedPolicyDocument; Request ID: 2ebc5411-dc37-48aa-9a8b-14aedc806049; Proxy: null)

	new Policy (/private/var/folders/wv/gltyfn4j6f910j0cydhb2bwc0000gp/T/jsii-kernel-RoWLs1/node_modules/@aws-cdk/aws-iam/lib/policy.js:42:26)
	\_ Role.addToPrincipalPolicy (/private/var/folders/wv/gltyfn4j6f910j0cydhb2bwc0000gp/T/jsii-kernel-RoWLs1/node_modules/@aws-cdk/aws-iam/lib/role.js:17

Simple Fix

Opening a PR for this, but just need to inject ${Aws.PARTITION} in place of aws in constructed arn in the codebuild/lib/project.ts package linked above.

---

This is 🐛 Bug Report