fix(iam): add validation for OrganizationPrincipal IDs

[scorbiere]

Issue # (if applicable)

Closes #32756.

Reason for this change

There's a security issue with the OrganizationPrincipal class in AWS CDK. When using iam.OrganizationPrincipal with an empty or invalid organization ID, it still grants access to AWS resources but without properly applying the organization condition. This creates a security risk because:

1. It grants permissions to AWS: "*" (any AWS principal)
2. The condition that should restrict access to a specific organization is not properly applied

A previous fix (PR #33555) was implemented but later reverted (PR #33773) because it broke compatibility with code using tokens for organization IDs.

Description of changes

This PR adds token-aware validation to the OrganizationPrincipal constructor to ensure organization IDs match the required pattern (^o-[a-z0-9]{10,32}$) when they are literal strings, while maintaining compatibility with tokens.

Pattern defined here: https://docs.aws.amazon.com/organizations/latest/APIReference/API_Organization.html#API_Organization_Contents

Key changes:

• Added validation in OrganizationPrincipal constructor that only applies to literal strings (not tokens)
• Created comprehensive unit tests for the validation logic
• Updated existing tests to use valid organization IDs

The implementation uses Token.isUnresolved() to check if the organization ID is a token before applying validation, which addresses the regression that caused the previous fix to be reverted.

Describe any new or updated permissions being added

No new IAM permissions are being added. This change only affects validation of organization IDs used in IAM policies.

Description of how you validated changes

• Added a dedicated test file (organization-principal.test.ts) which covers various scenarios:
  • Valid organization IDs
  • Empty strings (rejected with error)
  • Invalid formats (rejected with error)
  • Token values (pass through without validation)
• Updated existing tests in function.test.ts, bucket.test.ts, and integration tests to use valid organization IDs
• Verified all unit tests pass in the affected modules
• Ran integration tests to ensure the changes work correctly in deployed resources

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.98%. Comparing base (89d2d5c) to head (b73ca37).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33968   +/-   ##
=======================================
  Coverage   83.98%   83.98%           
=======================================
  Files         120      120           
  Lines        6976     6976           
  Branches     1178     1178           
=======================================
  Hits         5859     5859           
  Misses       1005     1005           
  Partials      112      112           

Flag	Coverage Δ
suite.unit	83.98% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	∅ <ø> (∅)
packages/aws-cdk-lib/core	83.98% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[QuantumNeuralCoder]

Reviewed as previously. Additional check for cdk token prevents the regression issue. Ship ITTT

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: b73ca37
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.