fix(events): now EventBus.grantPutEventsTo correctly handles service principals

[scorbiere]

Issue #22080

Closes #22080.

Reason for this change

When trying to grant PutEvents permissions to an AWS Service Principal using grantPutEventsTo, the method performed a no-op without any warnings or errors. This prevented users from properly granting permissions to service principals, even though this is a valid use case that can be done through the AWS Console. The change implements the correct behavior by creating an EventBusPolicy when dealing with service principals.

Description of changes

• Added special handling for service principals in EventBus.grantPutEventsTo method
• When granting permissions to a service principal, creates an EventBusPolicy instead of attempting to modify IAM policies
• Returns iam.Grant.drop() for service principals to indicate permissions are handled via EventBusPolicy
• Added test cases to verify both service principal and IAM principal scenarios

Describe any new or updated permissions being added

The change introduces the creation of EventBusPolicy resources with events:PutEvents permission when granting access to service principals. This is not a new permission, but rather a different way of granting the same permission through resource-based policies instead of identity-based policies.

Description of how you validated changes

Added new test cases that verify:

• EventBusPolicy is correctly created when granting permissions to service principals
• IAM policies are correctly created when granting permissions to IAM roles/users

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Please upload report for BASE (main@6e0aa13). Learn more about missing BASE report.
Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33729   +/-   ##
=======================================
  Coverage        ?   82.37%           
=======================================
  Files           ?      120           
  Lines           ?     6933           
  Branches        ?     1169           
=======================================
  Hits            ?     5711           
  Misses          ?     1119           
  Partials        ?      103           

Flag	Coverage Δ
suite.unit	82.37% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	∅ <ø> (?)
packages/aws-cdk-lib/core	82.37% <ø> (?)

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 50bd792
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository