(route53): Support grantDelegation on imported PublicHostedZone

[Gyakusetsu]

Describe the bug

Traceback (most recent call last):
  File "/home/rimuru/hosted-zone-stack/app.py", line 10, in <module>
    HostedZoneStack(app, "HostedZoneStack", 
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/rimuru/hosted-zone-stack/.venv/lib64/python3.11/site-packages/jsii/_runtime.py", line 112, in __call__
    inst = super().__call__(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/rimuru/hosted-zone-stack/hosted_zone_stack/hosted_zone_stack.py", line 24, in __init__
    parent_domain_zone.grant_delegation(sub_domain_delegation_role)
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/rimuru/hosted-zone-stack/.venv/lib64/python3.11/site-packages/jsii/_reference_map.py", line 153, in __getattr__
    raise AttributeError(f"'%s' object has no attribute '%s'" % (type_info, name))
AttributeError: '<class 'aws_cdk.Resource'>+<class 'aws_cdk.aws_route53._IHostedZoneProxy'>' object has no attribute 'grant_delegation'

Expected Behavior

I should be able to use grant_delegation from existing zone that is not created with the same cdk stack.

Current Behavior

Can't use grant_delegation in python and grantDelegation in javascript

Reproduction Steps

from aws_cdk import (
    Stack,
    aws_route53 as route53,
    aws_iam as iam,
)
from constructs import Construct

class HostedZoneStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        
        sub_account_principal = iam.AccountPrincipal('111111111111')
        sub_domain_delegation_role = iam.Role(self, 'SubDomainDelegationRole', 
            role_name='PredictableRoleName',
            assumed_by=sub_account_principal
        )
        
        parent_domain_zone: route53.PublicHostedZone = route53.PublicHostedZone.from_hosted_zone_id(self, 
            id='ParentHostedZone', 
            hosted_zone_id='Z01234567891234567890', # REPLACE
        )
        
        parent_domain_zone.grant_delegation(sub_domain_delegation_role)

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.86.0 (build 1130fab)

Framework Version

No response

Node.js Version

v16.20.1

OS

Fedora Linux 38 (Server Edition)

Language

Python

Language Version

Python 3.11.3

Other information

No response

[peterwoodworth]

Imported resources are inherently limited since we cannot modify the imported resoruce
https://docs.aws.amazon.com/cdk/v2/guide/resources.html#resources_external

The return value of the import is IPublicHostedZone which is not documented to have this method, so this isn't a bug. However, I don't think there's any reason we can't support this method, since we aren't modifying the resource but are instead adding a permission to a different grantee.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.