Describe the bug

When referencing a value from a source stack in two destination regions, only the first region is granted permissions on the CrossRegionExportWriterCustomerResourceProvider/Role, resulting in a stack deployment failure with insufficient permissions on ssm:ListTagsForResource in the second destination region.

Expected Behavior

Expected behaviour is for the IAM role to include each of the destination regions required.

Current Behavior

IAM Statement Changes:
Resource: "arn:aws:ssm:ap-southeast-1:082966487824::parameter/cdk/exports/*"
Effect: Allow
Action: ssm:DeleteParameters, ssm:GetParameters,ssm:ListTagsForResource,ssm:PutParameter
Principal: AWS:${Custom::CrossRegionExportWriterCustomResourceProvider/Role}

Error
8:48:55 am | CREATE_FAILED | Custom::CrossRegionExportWriter | ExportsWriterapsou...t2235C849A8E92266D
Received response status [FAILED] from custom resource. Message returned: AccessDeniedException: User: arn:aws:sts::082966487824:assumed-role/sourceStack-
CustomCrossRegionExportWriterCustomRes-1L7WV0YX11H2H/sourceStack-CustomCrossRegionExportWriterCustomRes-XU6vlSVHMoXz is not authorized to perform: ssm:Lis
tTagsForResource on resource: arn:aws:ssm:ap-southeast-2:082966487824:parameter/cdk/exports/Region2Stack/sourceStackuseast1RefhostedZone861779BD20ED3C2C b
ecause no identity-based policy allows the ssm:ListTagsForResource action

Reproduction Steps

Sample Repo Code:

import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { Stack } from 'aws-cdk-lib';

const app = new cdk.App();
var sourceStack = new Stack(app, 'sourceStack', {  env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: 'us-east-1' } });
var hostedZone = new cdk.aws_route53.HostedZone(sourceStack, "hostedZone", { zoneName: 'test.local'});

var destRegion1Stack = new Stack(app, 'Region1Stack',  {  env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: 'ap-southeast-1' }, crossRegionReferences: true });
new cdk.aws_route53.TxtRecord(destRegion1Stack, "FirstARecord", { zone: hostedZone, recordName: 'ap-southeast-1', values: ['ap-southeast-1'] });

var destRegion2Stack = new Stack(app, 'Region2Stack',  {  env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: 'ap-southeast-2' }, crossRegionReferences: true });
new cdk.aws_route53.TxtRecord(destRegion2Stack, "SecondARecord", { zone: hostedZone, recordName: 'ap-southeast-2', values: ['ap-southeast-2'] });

Possible Solution

the IAM role should include permissions to all required regions.

Additional Information/Context

No response

CDK CLI Version

2.67.0 (build b6f7f39)

Framework Version

No response

Node.js Version

v18.13.0

OS

MacOs/Linux/Agnostic

Language

Typescript

Language Version

Typescript (v10.9.1)

Other information

No response