fix(codebuild): race condition between CfnProject and IAM Policy for CodeConnections

[ryutasato]

Issue # (if applicable)

Closes #38504.

Reason for this change

When creating a codebuild.Project with CODECONNECTIONS (or CODESTAR_CONNECTIONS) source authentication, CloudFormation attempts to create AWS::CodeBuild::Project before the AWS::IAM::Policy granting codeconnections:UseConnection is fully attached and propagated to the project's service role. The CodeBuild CreateProject API validates the connection synchronously using the role's permissions, resulting in an OAuthProviderException deployment failure.

Users must currently work around this by manually creating a dedicated iam.Policy and calling cfnProject.addResourceDependency() — a pattern that should be handled automatically by the construct.

Description of changes

• Modified packages/aws-cdk-lib/aws-codebuild/lib/project.ts to detect when CODECONNECTIONS or CODESTAR_CONNECTIONS source authentication is configured
• When detected, automatically adds a CloudFormation DependsOn dependency from AWS::CodeBuild::Project to the AWS::IAM::Policy resource(s) associated with the project's service role
• This ensures IAM policy attachment and propagation completes before CreateProject is called

Synthesized template change:

  BuildProject:
    Type: AWS::CodeBuild::Project
+   DependsOn:
+     - BuildProjectCodeConnectionsPolicy
    Properties:
      ServiceRole: !GetAtt BuildProjectRole.Arn

• No breaking changes — the fix only adds DependsOn metadata to the CloudFormation template
• No public API changes — existing user code requires zero modifications
• Non-CodeConnections project sources are completely unaffected

Describe any new or updated permissions being added

N/A — No new IAM permissions are introduced. The change only affects CloudFormation resource dependency ordering to ensure existing permissions are propagated before they are needed.

Description of how you validated changes

• Unit tests: Added tests in packages/aws-cdk-lib/aws-codebuild/test/project.test.ts verifying that Project with CODECONNECTIONS source authentication synthesizes a template containing DependsOn referencing the IAM policy resource
• Integration tests: Verified with real AWS CloudFormation deployments:
  • Without DependsOn: AWS::CodeBuild::Project creation fails with OAuthProviderException
  • With DependsOn: Deployment succeeds deterministically — AWS::IAM::Policy reaches CREATE_COMPLETE before AWS::CodeBuild::Project creation begins
• Regression tests: Confirmed zero template diff for existing non-CodeConnections project sources

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.