Describe the bug

When updating an eks Cluster, there is no permission to DeleteCluster from Role if there are destructive changes to the cluster.

https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-eks/lib/cluster-resource.ts#L152-L166

The following rolls failed. Probably because of the following

1. The "resource" in the IAM policy is changed to the new cluster.
2. Attempting to "eks:DeleteCluster" on the old cluster
3. the deletion fails because the access rights to the old cluster were revoked in 1.

Expected Behavior

Successful deletion

Current Behavior

Failure to do this.

Reproduction Steps

First deployed as follows.

    new eks.Cluster(this, 'hello-eks', {
      version: eks.KubernetesVersion.V1_24,
      kubectlLayer: new KubectlV24Layer(this, 'kubectl'),
    });

Then update by rewriting it like this (changing the cluster name is a destructive change)

    new eks.Cluster(this, 'hello-eks', {
      clusterName: "sample",
      version: eks.KubernetesVersion.V1_24,
      kubectlLayer: new KubectlV24Layer(this, 'kubectl'),
    });

Possible Solution

EKS:DeleteCluster's Statement separation, Resouce='*'

Additional Information/Context

No response

CDK CLI Version

2.62.2

Framework Version

No response

Node.js Version

any

OS

any

Language

Typescript

Language Version

No response

Other information

No response