feat(appconfig): add grantReadConfig method to Environment Construct

packages/aws-cdk-lib/aws-appconfig/README.md

@@ -78,11 +78,11 @@ new appconfig.Environment(this, 'MyEnvironment', {
 Environment monitors also support L1 `CfnEnvironment.MonitorsProperty` constructs through the `fromCfnMonitorsProperty` method.
 However, this is not the recommended approach for CloudWatch alarms because a role will not be auto-generated if not provided.
 
-See [About the AWS AppConfig data plane service](https://docs.aws.amazon.com/appconfig/latest/userguide/about-data-plane.html) more information.
+See [About the AWS AppConfig data plane service](https://docs.aws.amazon.com/appconfig/latest/userguide/about-data-plane.html) for more information.
 
 ### Permissions
 
-You can grant read configuration permission on an Environment to any Principal as follows:
+You can grant permissions to read a configuration to an Environment with the grantReadConfig method as follows:
 ```ts
 import * as iam from 'aws-cdk-lib/aws-iam';
 

packages/aws-cdk-lib/aws-appconfig/lib/environment.ts

@@ -561,15 +561,17 @@ export interface IEnvironment extends IResource {
   addExtension(extension: IExtension): void;
 
   /**
-   * Grant the given identity the specified actions
-   * @param grantee the identity to be granted the actions
-   * @param actions the data-access actions
+   * Adds an IAM policy statement associated with this environment to an IAM principal's policy.
+   *
+   * @param grantee the principal (no-op if undefined)
+   * @param actions the set of actions to allow (i.e., 'appconfig:GetLatestConfiguration', 'appconfig:StartConfigurationSession', etc.)
    */
   grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
 
   /**
-   * Grants read configuration permissions for this environment
-   * to an IAM principal (Role/Group/User).
+   * Permits an IAM principal a configuration read operations on this environment.
+   *
+   * Actions: GetLatestConfiguration, StartConfigurationSession.
    *
    * @param grantee Principal to grant read rights to
    */