feat(events-targets): use IAM role for SnsTopic target

[mellevanderlinde]

Issue # (if applicable)

There's currently no issue for this, but I'd be happy to create it.

Reason for this change

Using an IAM role also fixes potential issues of failed published messages in case the target SNS topic is encrypted with KMS. According to this article, it's recommended to use execution roles for EventBridge targets.

https://aws.amazon.com/about-aws/whats-new/2025/03/amazon-eventbridge-iam-execution-role-all-targets/

We recommend configuring execution roles for all your EventBridge targets to benefit from consistent permissions policies and (...)

Description of changes

The SnsTopic target now creates an IAM role by default, having sns:Publish permissions. Optionally, a custom role can be provided to the props of SnsTopic.

Describe any new or updated permissions being added

The sns:Publish action is allowed on the topicArn.

Description of how you validated changes

Unit tests were updated and added. An integ test with a custom role was added. The already existing integ test uses the default role that is attached to the SNS target.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: c250cb3
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository