User: arn:aws:iam::xxxxxxxxxxxx:user/<AMPLIFY-CONFIGURE-USER> is not authorized to perform: apigateway:TagResource on resource: arn:aws:apigateway:eu-west-3::/apis/<APIID>/stages (Service: AmazonApiGatewayV2; Status Code: 403; Error Code: AccessDeniedException; Request ID: xxxx; Proxy: null)

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

_No response_

### Amplify CLI Version

11.0.3

### What operating system are you using?

Ubuntu

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No manual changes on concerned resources

### Describe the bug

Hello, I am trying to create an API Gateway websocket with amplify add custom (cdk).
I am using cdk V1 because aws_apigatewayv2 of the cdk V2 is in alpha.

Here's my package.json dependencies :
```
"dependencies": {
"@aws-amplify/cli-extensibility-helper": "^2.0.0",
"@aws-cdk/core": "~1.198.0",
"@aws-cdk/aws-apigatewayv2": "~1.198.0",
"@aws-cdk/aws-apigatewayv2-integrations": "~1.198.0",
"@aws-cdk/aws-lambda": "~1.198.0"
},
"devDependencies": {
"typescript": "^4.2.4"
}
```

Here's the relevant CDK code used:
```
const webSocketApi = new WebSocketApi(this, "XXXXX", {
apiName: "XXX",
// this is the default expression, just putting it here for verbose purpose
routeSelectionExpression: "$request.body.action",
connectRouteOptions: {
integration: new WebSocketLambdaIntegration(
"connectIntegration",
connectHandler
),
},
disconnectRouteOptions: {
integration: new WebSocketLambdaIntegration(
"disconnectIntegration",
disconnectHandler
),
},
});

new WebSocketStage(this, "websocketStage", {
webSocketApi,
stageName: cdk.Fn.ref("env"),
autoDeploy: true,
});
```

Everything is generated fine if I remove the WebsocketStage bit.
The error encountered is the one written in the subject which is :

User: arn:aws:iam::XXXX:user/ is not authorized to perform: apigateway:TagResource on resource: arn:aws:apigateway:eu-west-3::/apis//stages (Service: AmazonApiGatewayV2; Status Code: 403; Error Code: AccessDeniedException; Request ID: XXX; Proxy: null)

it seems that the AdministratorAccess-Amplify policy attached to the amplify created user through amplify configure lacks the apigateway:TagResource permission.

I can't find a way to append a statement to this existing policy like the following :
```
amplifyPolicy.appendToPolicy(
new PolicyStatement({
actions: [
"apigateway:TagResource",
],
resources: [*],
})
)
```

I would like to do it with the CDK, and not manually, so that my colleagues could access it without manual interaction with the console, on every user/account-environment we have.

Or maybe this AWs managed policy should contain this statement by default.

### Expected behavior

The custom resource Stage of my custom websocket should be created without a permission error.

### Reproduction steps

1. Create an amplify user through amplify configure
2. Attach to it the policy arn:aws:iam::aws:policy/AdministratorAccess-Amplify
3. amplify add custom
4. use cdk v1
5. import { WebSocketLambdaIntegration } from "@aws-cdk/aws-apigatewayv2-integrations"; import { WebSocketApi, WebSocketStage } from "@aws-cdk/aws-apigatewayv2";
6. code a websocket API (see bug description for reference)
6. Initialize a WebSocketStage (see bug description for reference)
7. amplify push

### Project Identifier

_No response_

### Log output

```
User: arn:aws:iam::XXXX:user/ is not authorized to perform: apigateway:TagResource on resource: arn:aws:apigateway:eu-west-3::/apis//stages (Service: AmazonApiGatewayV2; Status Code: 403; Error Code: AccessDeniedException; Request ID: XXX; Proxy: null)

```

### Additional information

Thank you for help !

### Before submitting, please confirm:

- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

Start with package.json and the custom CDK construct containing WebSocketApi and WebSocketStage, then reproduce the failure with amplify push using the listed Amplify CLI and CDK versions. Trace the AdministratorAccess-Amplify permissions involved in apigateway:TagResource. Done means the WebSocketStage is created without the permission error, with the supported permission-management path identified.

Written by the indexing model from the issue text.