Describe the bug

The policy generated in case of ECS tasks trigger in a state machine are of this type:

{
    "Action": "ecs:RunTask",
	"Resource": [
		"arn:aws:ecs:eu-central-1:xxxx:task-definition/my-task:*",
		"arn:aws:ecs:eu-central-1:xxxx:task-definition/my-task"
	],
	"Effect": "Allow"
},

the Resource "arn:aws:ecs:eu-central-1:xxxx:task-definition/my-task" is not a valid one, the policy validator fail in the UI (even if I'm able to deploy) and there is an AWS notification about my state machine role.

Expected Behavior

The resource used for ecs:RunTask is simply:
"arn:aws:ecs:eu-central-1:xxxx:task-definition/my-task:*",

Current Behavior

the resources for ecs:RunTask are:

• "arn:aws:ecs:eu-central-1:xxxx:task-definition/my-task:*",
• "arn:aws:ecs:eu-central-1:xxxx:task-definition/my-task"

Reproduction Steps

Create a state machine invoking an ecs task

Possible Solution

Simply remove the not necessary resource from then policy attach to the IAM role used by the statemachine.
Creating a role, and passing to sfn.StateMachine doesn't help, because an inline policy with the wrong inline policy is attach to the custom role.

Additional Information/Context

No response

CDK CLI Version

2.147.3

Framework Version

No response

Node.js Version

v18.0.0

OS

MacOs

Language

TypeScript

Language Version

No response

Other information

No response