fix(stepfunctions-tasks): tighten permissions in SubmitBatchJob to scoped job definitions

[wasim-builds]

Summary

Tighten IAM permissions in SubmitBatchJob to scope job definition references instead of granting broad batch permissions.

Problem

The SubmitBatchJob task was granting permissions that were broader than necessary, potentially allowing access to job definitions outside the intended scope.

Fix

Restrict the IAM policy to only the specific job definition ARN passed to the task, following the principle of least privilege.

Security impact

Reduces blast radius by preventing the task role from interacting with unintended Batch resources.

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[aws-cdk-automation]

(This review is outdated)

[wasim-builds]

Rebased onto latest upstream/main. No other changes.

[wasim-builds]

Exemption Request

This PR tightens IAM permissions in SubmitBatchJob by scoping the batch:SubmitJob action to specific job definitions instead of *. This is a purely additive permission narrowing — it restricts the existing wildcard to a scoped set, which does not change any runtime behavior observable in an integration test snapshot.

The change is fully covered by existing unit tests in submit-job.test.ts (57 lines of test additions). An integration test run would produce the same snapshot structure (same resources created, same deployment flow), just with different IAM policy strings. Running integ tests here would require significant CI resources with no additional coverage benefit.

Justification: Adding a new integration test (or modifying an existing one) for a permission-scoping change that does not alter the deployed resource shape or behavior would incur unnecessary CI cost and review latency without improving coverage.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[github-actions]

⚠️ This pull request description does not follow the correct template structure.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like Closes #123 in the Issue section. If no existing issue matches your change, create one first.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.