CdkPipelines: Policy has invalid action (Service: S3) on x-region support stacks

[ahammond]

Describe the bug

Upgrade repo with working CdkPipeline to 2.101.0 and the UpdatePipeline phase of the stack fails.

TimeHubServicePipeline-support-ap-southeast-2 | 11:42:37 a.m. | UPDATE_FAILED        | AWS::S3::BucketPolicy | cross-region-stack-013819181968:ap-southeast-2/Default/CrossRegionCodePipelineReplicationBucket/Policy (CrossRegionCodePipelineReplicationBucketPolicyB7BA2BCA) Resource handler returned message: "Policy has invalid action (Service: S3, Status Code: 400, Request ID: A43ZEYSTPQ8JZ69H, Extended Request ID: gAbp0MhttcZwWTxYbenp05weTvHnKVBJhNH3Zf75FHyDk+Q7GKxBhPA+MRSpig3rA5ayL6VehDSu9npTjhAwPQ==)" (RequestToken: 8f1c9262-a86d-d5ca-5ade-211168db1fb3, HandlerErrorCode: GeneralServiceException)

Expected Behavior

Only BREAKING CHANGES should break old stuff.

Current Behavior

Above.

Reproduction Steps

Create a cdk pipeline with older version of cdk libs. Upgrade to newer version, watch UpdatePipeline fail to deploy.

Alternatively, start with aws-cdk-lib v2.101.0 and attempt to deploy a pipleline that requires a cross-region stack.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.101.0 (build cbaa50e)

Framework Version

2.101.0 (build cbaa50e)

Node.js Version

18.17.1

OS

irrelevant

Language

TypeScript

Language Version

5.1.6

Other information

No response

[ahammond]

Looks like this is a duplicate of #27547

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.