feat(apigatewayv2): WebSocketStage support accessLogSettings, cloudWatchRole, cloudWatchRoleRemovalPolicy

[phuhung273]

Issue # (if applicable)

Closes #21935

Reason for this change

WebSocketStage access log

Description of changes

WebSocketStage support

• accessLogSettings
• cloudWatchRole, cloudWatchRoleRemovalPolicy to create required role. Without this role setup, accessLogSettings will fail with error CloudWatch Logs role ARN must be set in account settings to enable logging

Describe any new or updated permissions being added

cloudWatchRole: true will create below Role

{
  "RoleName": "CloudWatchRole",
  "AssumeRolePolicyDocument": {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "apigateway.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  },
  "ManagedPolicyArns": [
    "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
  ]
}

Description of how you validated changes

Unit + Integ

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 7662595
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository