fix(custom-resources): cross-environment call fails in opt-in region

[scanlonp]

Currently, the region parameter in AwsCustomResource only controls where the action is performed. If a role needs to be assumed, the assumeRole call is made from the region the stack is deployed into. This presents a problem if the stack is deployed into an opt-in region, and the role being assumed lives in a separate stack in an account without the opt-in region enabled.

This change makes the assumeRole call and the sdk call performed in the same region. Therefore, to solve the above problem, pass any region that is enabled for the account that owns the role to be assumed.

Closes #26562.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[rix0rrr]

Conditionally approved!

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[scanlonp]

Moving my personal checklist to comments.

TODO:

• Specify accounts for the integ test to provide coverage for cross account and opt-in / non-opt-in region relationship

• reference cross account integ test

• Add unit tests to verify the configuration of the sts assumeRole call covered by integ test

Future work, not needed to merge

• Roll this change into addressing Route53’s CrossAccountZoneDelegationRecord is broken in v2.87+ for opt-in region to non-opt-in region #26593

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: e7d146a
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).