fix(core): share a single IAM role across cross-account Fn::GetStackOutput consumers

[otaviomacedo]

For cross-account references, the producer creates one role per reference.

Change it to create a single IAM role with all consumer principals in its trust policy. The role and policy construct IDs are now stable (GetStackOutputRole / GetStackOutputPolicy) rather than derived from each reference's resolved value, ensuring idempotent construct creation. The trust policy uses Lazy.any to defer principal resolution, accumulating consumers as references are discovered.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

⚠️ This pull request description does not follow the correct template structure.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like Closes #123 in the Issue section. If no existing issue matches your change, create one first.

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.
To suppress a specific rule, see Suppressing Rules.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	96 ran	96 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.
To suppress a specific rule, see Suppressing Rules.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	96 ran	96 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-05-15 14:01 UTC · Rule: default-squash
• ✅ Checks passed · in-place
• ✅ Merged — 2026-05-15 14:49 UTC · at c07f626efd1f35053f898ccf7de079e73de441f8 · squash

This pull request spent 47 minutes 34 seconds in the queue, including 46 minutes 42 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • fix(core): share a single IAM role across cross-account Fn::GetStackOutput consumers #37871
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • fix(core): share a single IAM role across cross-account Fn::GetStackOutput consumers #37871
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.