(AwsSdkCall): AccessDenied when installLatestAwsSdk is false due to credential caching?

### Describe the bug

I'm using AwsSdkCall custom resource to operate on S3. We had timeout problems in China due to installing the latest SDK taking too long, so I disabled it using `installLatestAwsSdk: false`. Now though, I'm seeing failures quite often due to access denied which I believe is because AwsSdkCall keeps making/changing the IAM role and IAM is perhaps caching a bit and causing the access denied problem because it will work on retry.

I tried assigning a role to AwsSdkCall which has the necessary permissions rather than letting AwsSdkCall just create a policy, however this has not fixed the problem.

It seems that installing the latest AWS SDK took enough time to ensure that all the credentials were properly configured, which is why I didn't have this problem until I removed that to speed things up and avoid timeouts in slower regions.

### Expected Behavior

AwsSdkCall should have a retry configuration, avoid changing IAM roles, or another solution to avoid needing to manually retry the CFN deployment.

### Current Behavior

AccessDenied error is raised causing the stack deployment to fail.

### Reproduction Steps

```typescript
const copyObject: custom.AwsSdkCall = {
action: 'copyObject',
service: 'S3',
physicalResourceId: custom.PhysicalResourceId.of(`myResourceId`),
parameters: {
Bucket: props.s3Bucket.bucketName,
CopySource: "/source.zip",
Key: this.publishedUri
}
};

const copy = new custom.AwsCustomResource(this, `CopyToKnownLocation`, {
role: props.s3UsageRole,
// Policy isn't optional, even though I'm giving it a specific role
policy: {
statements: [
new PolicyStatement({
effect: Effect.ALLOW,
actions: [
's3:Get*',
's3:Put*',
's3:Copy*'
],
resources: [
props.s3Bucket.bucketArn,
Fn.join("", [props.s3Bucket.bucketArn, '/*'])
]
})
]
},
onCreate: copyObject,
onUpdate: copyObject,
installLatestAwsSdk: false,
});
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

1.179.0

### Framework Version

_No response_

### Node.js Version

14

### OS

Linux

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start by tracing AwsCustomResource's AwsSdkCall handling when installLatestAwsSdk is false, using the provided S3 copyObject reproduction and the assigned IAM role as the case to investigate. Done means the custom resource no longer intermittently fails with AccessDenied during deployment, without requiring manual retries.

Written by the indexing model from the issue text.