fix(scheduler-targets-alpha): add dlq policy to execution role instead of queue policy

[gracelu0]

Issue # (if applicable)

Tracking #31785.

Reason for this change

Currently if a dead letter queue (DLQ) is specified then a queue policy is created for the DLQ which allows the schedule to send messages. This is incorrect and the permissions should be added to the schedule's execution role instead.

Description of changes

Add sqs:SendMessage permission to execution role's policy statement if dead letter queue is specified. This follows the service docs for configuring a schedule DLQ.

Also removed cross-region validation as the deployment will fail fast for this case so the validation is unnecessary.

Description of how you validated changes

Updated unit tests and added a new integration test with dead letter queue setup on the schedule

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[samson-keung]

For integ test, you can write one similar to integ.schedule.ts but intentionally have missing target invocation permission in the execution role. A rate-based schedule without time window is invoked right away when created. Then use assert to check the queue has the expected message.

[xazhao]

LGTM

Addressed comments and he is on vacation so I am not going to bother him more

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: fe451ba
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.