fix(cloudtrail): do not attach s3 bucket permission when orgId is not set for organization trail

[sarisia]

Recreate #30490

Issue # (if applicable)

no open issue

Reason for this change

Organization trail without orgId attaches improper s3 bucket policy
which allows cloudtrail to write to /AWSLogs/undefined/* prefix.

                        {
                            "Action": "s3:PutObject",
                            "Condition": {
                                "StringEquals": {
                                    "s3:x-amz-acl": "bucket-owner-full-control",
                                    "aws:SourceArn": {
                                        "Fn::Join": [
                                            "",
                                            [
                                                "arn:",
                                                {
                                                    "Ref": "AWS::Partition"
                                                },
                                                ":cloudtrail:us-east-1:123456789012:trail/undefined"
                                            ]
                                        ]
                                    }
                                }
                            },
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "cloudtrail.amazonaws.com"
                            },
                            "Resource": {
                                "Fn::Join": [
                                    "",
                                    [
                                        {
                                            "Fn::GetAtt": [
                                                "TrailS30071F172",
                                                "Arn"
                                            ]
                                        },
                                        "/AWSLogs/undefined/*"
                                    ]
                                ]
                            }
                        }

Description of changes

• do not attach s3 bucket policy if isOrganizationTrail is set and orgId is not set
  • generate warning if attaching s3 bucket policy is skipped

Description of how you validated changes

• added unit test

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[sarisia]

Exemption Request: deploying this requires AWS organization management account

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 5b8134d
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[sarisia]

could someone review this please? I'm waiting this for 4 months, thanks!