fixes issue with CloudWatch Logs custom log KMS permissions (#1293)

* update role permissions

* update

* Update

* pin docker image

Author: rjjaegeraws

src/deployments/cdk/src/deployments/iam/log-group-role.ts

@@ -51,5 +51,12 @@ async function createRole(stack: AccountStack) {
       resources: ['*'],
     }),
   );
+
+  role.addToPrincipalPolicy(
+    new iam.PolicyStatement({
+      actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey'],
+      resources: ['*'],
+    }),
+  );
   return role;
 }

src/lib/cdk-accelerator/src/codebuild/cdk-deploy-project.ts

@@ -146,7 +146,7 @@ export class PrebuiltCdkDeployProject extends CdkDeployProjectBase {
     fs.writeFileSync(
       path.join(this.projectTmpDir, 'Dockerfile'),
       [
-        'FROM public.ecr.aws/bitnami/node:22',
+        'FROM public.ecr.aws/bitnami/node:22.13.0',
         // Install the package manager
         ...installPackageManagerCommands(props.packageManager).map(cmd => `RUN ${cmd}`),
         `WORKDIR ${appDir}`,