feat(toolkit-lib): surface CloudTrail control-plane errors for failed resources

.projenrc.ts

@@ -895,6 +895,7 @@ const toolkitLib = configureProject(
       sdkDep('@aws-sdk/client-cloudformation'),
       sdkDep('@aws-sdk/client-cloudwatch-logs'),
       sdkDep('@aws-sdk/client-cloudcontrol'),
+      sdkDep('@aws-sdk/client-cloudtrail'),
       sdkDep('@aws-sdk/client-codebuild'),
       sdkDep('@aws-sdk/client-ec2'),
       sdkDep('@aws-sdk/client-ecr'),

packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/sdk.ts

@@ -172,6 +172,14 @@ import {
   ListChangeSetsCommand,
 } from '@aws-sdk/client-cloudformation';
 import type { OperationEvent } from '@aws-sdk/client-cloudformation/dist-types/models/models_0';
+import {
+  CloudTrailClient,
+  LookupEventsCommand,
+} from '@aws-sdk/client-cloudtrail';
+import type {
+  LookupEventsCommandInput,
+  LookupEventsCommandOutput,
+} from '@aws-sdk/client-cloudtrail';
 import type {
   FilterLogEventsCommandInput,
   FilterLogEventsCommandOutput,
@@ -535,6 +543,10 @@ export interface ICloudWatchLogsClient {
   filterLogEvents(input: FilterLogEventsCommandInput): Promise<FilterLogEventsCommandOutput>;
 }
 
+export interface ICloudTrailClient {
+  lookupEvents(input: LookupEventsCommandInput): Promise<LookupEventsCommandOutput>;
+}
+
 export interface ICodeBuildClient {
   updateProject(input: UpdateProjectCommandInput): Promise<UpdateProjectCommandOutput>;
 }
@@ -904,6 +916,14 @@ export class SDK {
     };
   }
 
+  public cloudTrail(): ICloudTrailClient {
+    const client = new CloudTrailClient(this.config);
+    return {
+      lookupEvents: (input: LookupEventsCommandInput): Promise<LookupEventsCommandOutput> =>
+        client.send(new LookupEventsCommand(input)),
+    };
+  }
+
   public codeBuild(): ICodeBuildClient {
     const client = new CodeBuildClient(this.config);
     return {

packages/@aws-cdk/toolkit-lib/lib/api/aws-auth/util.ts

@@ -1,5 +1,17 @@
 import * as fs from 'fs-extra';
 
+/**
+ * Whether an error from an AWS SDK call is an authorization failure.
+ *
+ * Services are inconsistent in how they phrase it: most raise `AccessDeniedException`
+ * (e.g. CloudTrail, SSM), some `AccessDenied` (e.g. S3), and some surface the code on
+ * `Code` rather than `name`. Match all of them.
+ */
+export function isAccessDeniedError(e: any): boolean {
+  const name = e?.name ?? e?.Code ?? '';
+  return name === 'AccessDenied' || name === 'AccessDeniedException';
+}
+
 /**
  * Read a file if it exists, or return undefined
  *