fix(apprunner): auto deployment not triggered due to insufficient permission

[pinelibg]

Issue # (if applicable)

Closes #26640.

Reason for this change

Auto deployment of an AppRunner service is not triggered even when the autoDeploymentsEnabled props is set to true.

This is because the access role lacks the necessary ecr:DescribeImages permission required by AppRunner.

Description of changes

The grantPull method grants permissions for pulling images to the access role. However, it does not include the ecr:DescribeImages permission required by AppRunner.

aws-cdk/packages/@aws-cdk/aws-apprunner-alpha/lib/service.ts

Line 1255 in 730fe63

this.source.ecrRepository.grantPull(this.accessRole);

Required policy of the AppRunner is documented in the doc (https://docs.aws.amazon.com/apprunner/latest/dg/security_iam_service-with-iam.html#security_iam_service-with-iam-roles → AWSAppRunnerServicePolicyForECRAccess).

So it adds ecr:DescribeImages permission to the role after the grantPull call.

Another fix for the same issue #29285 grants broader permission by allowing some actions for all resources (*) instead of just the source ECR repository.
This PR grants minimal required permissions.

Description of how you validated changes

• Updated the integration test snapshot and checked the IAM policy changes for the access role to include the appended ecr:DescribeImages permission for the ECR repository.
• There is no unit test for IAM policy for the access role currently, so I haven't modified or created any unit test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[pinelibg]

Exemption Request
I have validated the IAM policy changes on the access role by running integration test and checking the snapshot diff.
(5c93a0a#diff-e995c5eaacbb2bc5bcf2c9266d1067f5a514af924698b0c28e36e81e13a712a8R51)

[aws-cdk-automation]

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

[pinelibg]

(Re) Exemption Request
Since there are no unit tests in this repository that would validate the permissions of the IAM roles, I don't think that unit test is required for this change.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 1687ee1
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[aws-cdk-automation]

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

✅ A exemption request has been requested. Please wait for a maintainer's review.