Describe the bug

@aws-cdk/integ-tests-alpha module
https://docs.aws.amazon.com/cdk/api/v2/docs/integ-tests-alpha-readme.html

By default, the AwsApiCall construct will automatically add the correct IAM policies to allow the Lambda function to make the API call. It does this based on the service and api that is provided.

During the deployment, there are several lambda function and execution role are auto-generated by CDK.

Stack ARN in case helps for troubleshooting: arn:aws:cloudformation:us-west-2:673604154507:stack/IntegTestdevDefaultTestDeployAssert31A9C52F/5746bdf0-7d00-11ee-9e23-06a38c3b8f8b

Inside the state machine, we can see the error

AccessDeniedException: User: arn:aws:sts::673604154507:assumed-role/IntegTestdevDefaultTestDe-SingletonFunction76b3e830-5BWQ2YQ5iN2A/IntegTestdevDefaultTestDe-SingletonFunction76b3e83-fLl2b7TfQLmk is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-west-2:673604154507:function:CDKTemplate-Microscope-Scheduler-dev because no identity-based policy allows the lambda:InvokeFunction action

However, checking the auto-generated lambda execution role,one of the role IntegTestdevDefaultTestDe-SingletonFunction76b3e830-QIh9L3ag1iz4 has the permission "lambda:Invoke", but there is no "lambda:InvokeFunction" permission, another role IntegTestdevDefaultTestDe-SingletonFunction1488541a-PkTEiGn4sLHb has both "lambda:Invoke" and "lambda:InvokeFunction" permission automatically generated

Expected Behavior

inside AWS console, the below action is an invalid action, and console will throw validation error, may I know if this is a bug in CDK that auto-generate "lambda:Invoke" in action rather than "lambda:InvokeFunction"?

Current Behavior

We tried to use escape hatch to down to the L2/L1 construct to override the role permission, however, the L1 construct of Role is CfnResource not CfnRole, which is also a bit different from other construct like laws-lambda as I can get CfnRole and can be used by add_property_override
example of aws_lambda construct:

        fn = lambda_.Function(self, "MyLambda",
            code=lambda_.InlineCode("exports.handler = async () => { console.log('hello world'); };"),
            handler="index.handler",
            runtime=lambda_.Runtime.PYTHON_3_7
        )
        
        children = fn.node.find_all()
        for child in children:
            print(child, "->", child.node.id, "->", child.node.path)

printout with CfnRole as the construct

<aws_cdk.aws_lambda.Function object at 0x7f1df63e8d90> -> MyLambda -> cdk-1-xx/MyLambda
<aws_cdk.aws_iam.Role object at 0x7f1de43f80d0> -> ServiceRole -> cdk-1-xx/MyLambda/ServiceRole
<aws_cdk.aws_iam.CfnRole object at 0x7f1de43f8310> -> Resource -> cdk-1-xx/MyLambda/ServiceRole/Resource
<aws_cdk.aws_lambda.CfnFunction object at 0x7f1df62a3410> -> Resource -> cdk-1-xx/MyLambda/Resource

However, for @aws-cdk/integ-tests-alpha module, I can only get CfnResource construct (see attachment) and cannot use add_property_override to change the policy

Reproduction Steps

Question1: may I know how does the code intergated in the backend to choose which IAM Role to make the invokefunction action inside statemachine ? and how can we customised this IAM role please?

Question2: inside AWS console, the below action is an invalid action, and console will throw validation error, may I know if this is a bug in CDK that auto-generate "lambda:Invoke" in action rather than "lambda:InvokeFunction"?

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.104.0

Framework Version

No response

Node.js Version

n/a

OS

mac

Language

Python

Language Version

No response

Other information

No response