Describe the bug

When upgrading from v2.28.0 to v2.39.1, we noticed that our API Gateway (created via RestApi) changed the retention policy for the CloudWatchRole and Account sub-resources to RETAIN, which is extremely undesirable as it means these resources will be leaked when the stack is deleted.

It seems that this behavior was introduced in v2.38.0 via #10878, but the release notes don't mention it. They only say "CloudWatch logging should be disabled by default (under feature flag)", which has nothing to do with the retention policy, nor does it mention the feature flag itself, which seems to be @aws-cdk/aws-apigateway:disableCloudWatchRole.

Expected Behavior

Either the retention policy should not have been changed, or this change should have been explicitly included in the release notes.

Current Behavior

The retention policy changes, as reported by cdk diff.

Reproduction Steps

import textwrap

import aws_cdk
from aws_cdk import (
    aws_apigateway,
    aws_lambda,
    aws_logs,
)

def main():
    app = aws_cdk.App()

    env = aws_cdk.Environment(region="us-east-1", account='XXXXX')

    stack = aws_cdk.Stack(app, "sample-stack", env=env)

    lambda_function = aws_lambda.Function(
        stack,
        'sample-lambda-function',
        runtime=aws_lambda.Runtime.PYTHON_3_7,
        handler='index.handler',
        timeout=aws_cdk.Duration.seconds(5),
        code=aws_lambda.Code.from_inline(textwrap.dedent('''
            def handler(event, context):
                pass
        ''')),
        log_retention=aws_logs.RetentionDays.ONE_YEAR,
    )

    aws_apigateway.LambdaRestApi(stack, "sample-api-gateway", handler=lambda_function)

    app.synth()    

if __name__ == "__main__":
    main()

Then run cdk synth and cdk diff.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.39.1 (build f188fac)

Framework Version

No response

Node.js Version

v16.17.0

OS

Alpine 3.16

Language

Python

Language Version

3.10.6

Other information

No response