@aws-cdk/custom-resources: adding tagging to resource creation causes deployment errors

### Describe the bug

Creating a custom resource with tagging causes errors with some resource types, the example below all deploy with no problems but fail when the tag parameter is added.

``` python
connect_case_app_integration_custom_resource = custom_resources.AwsCustomResource(
self,
"Connect Case App Integration Custom Resource",
on_create=custom_resources.AwsSdkCall(
service="AppIntegrations",
action="CreateEventIntegration",
parameters={
"EventBridgeBus": "default",
"EventFilter": {
"Source": "aws.cases",
},
"Name": name,
"Description": "Amazon Connect app integration for enabling case event streams",
# Apr 12 2024 - Tags Cause an error with this custom resource for some reason
# "Tags": self.tags.rendered_tags,
},
physical_resource_id=custom_resources.PhysicalResourceId.from_response(
"EventIntegrationArn"
),
),
on_delete=custom_resources.AwsSdkCall(
service="AppIntegrations",
action="DeleteEventIntegration",
parameters={
"Name": name,
},
),
policy=custom_resources.AwsCustomResourcePolicy.from_sdk_calls(
resources=custom_resources.AwsCustomResourcePolicy.ANY_RESOURCE
),
timeout=Duration.seconds(15),
)

connect_cases_app_integration_association_custom_resource = custom_resources.AwsCustomResource(
self,
"Connect Cases App Integration Association Custom Resource",
on_create=custom_resources.AwsSdkCall(
service="Connect",
action="createIntegrationAssociation",
parameters={
"InstanceId": connect_instance.attr_id,
"IntegrationArn": connect_case_app_integration_custom_resource.get_response_field(
"EventIntegrationArn"
),
"IntegrationType": "EVENT",
"SourceType": "CASES",
# Apr 12 2024 - Tags Cause an error with this custom resource for some reason
# "Tags": self.tags.rendered_tags,
},
physical_resource_id=custom_resources.PhysicalResourceId.from_response(
"IntegrationAssociationId"
),
),
on_delete=custom_resources.AwsSdkCall(
service="Connect",
action="deleteIntegrationAssociation",
parameters={
"InstanceId": connect_instance.attr_id,
"IntegrationAssociationId": custom_resources.PhysicalResourceIdReference(),
},
),
policy=custom_resources.AwsCustomResourcePolicy.from_sdk_calls(
resources=custom_resources.AwsCustomResourcePolicy.ANY_RESOURCE
),
timeout=Duration.seconds(15),
)

connect_cases_association_custom_resource = custom_resources.AwsCustomResource(
self,
"Connect Cases Association Custom Resource",
on_create=custom_resources.AwsSdkCall(
service="Connect",
action="createIntegrationAssociation",
parameters={
"InstanceId": connect_instance.attr_arn,
"IntegrationArn": connect_cases_domain_custom_resource.get_response_field(
"domainArn"
),
"IntegrationType": "CASES_DOMAIN",
# Apr 12 2024 - Tags Cause an error with this custom resource for some reason
# "Tags": self.tags.rendered_tags,
},
physical_resource_id=custom_resources.PhysicalResourceId.from_response(
"IntegrationAssociationId"
),
),
on_delete=custom_resources.AwsSdkCall(
service="Connect",
action="deleteIntegrationAssociation",
parameters={
"InstanceId": connect_instance.attr_arn,
"IntegrationAssociationId": custom_resources.PhysicalResourceIdReference(),
},
),
policy=custom_resources.AwsCustomResourcePolicy.from_statements(
[
# This resource will fail to delete without admin permissions with this error: Received response status [FAILED] from custom resource. Message returned: Access denied updating the Amazon Connect service-linked role.
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"*",
],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"Connect:DescribeInstance",
],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"ds:DescribeDirectories",
],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["app-integrations:CreateEventIntegrationAssociation"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["mobiletargeting:GetApp"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["cases:GetDomain"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["wisdom:GetAssistant"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["wisdom:GetKnowledgeBase"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["wisdom:TagResource"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["voiceid:DescribeDomain"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["events:PutTargets"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["events:PutRule"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["iam:AttachRolePolicy"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["iam:CreateServiceLinkedRole"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["iam:PutRolePolicy"],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"Connect:CreateIntegrationAssociation",
],
resources=["*"],
),
# Extra Delete Permissions
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"connect:DeleteIntegrationAssociation",
],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"app-integrations:DeleteEventIntegrationAssociation",
],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"app-integrations:DeleteApplicationAssociation",
],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"events:ListTargetsByRule",
],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"events:RemoveTargets",
],
resources=["*"],
),
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=[
"events:DeleteRule",
],
resources=["*"],
),
]
),
timeout=Duration.seconds(15),
)
```
### Expected Behavior

Tags should be added

### Current Behavior

A deployment failure

### Reproduction Steps

Create a custom resource without tags, it works fine. Create a custom resource with tags it fails to deploy.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.137.0 (build bb90b4c)

### Framework Version

_No response_

### Node.js Version

v18.13.0

### OS

Ubuntu 23.10

### Language

Python

### Language Version

3.11

### Other information

_No response_

Start with the custom_resources.AwsCustomResource and AwsSdkCall entry points shown in the reproduction, then reproduce the tagged and untagged AppIntegrations and Connect calls. Capture the deployment error and compare the supported tag parameters for each resource type. Done means tagged creation succeeds for the affected calls without breaking untagged creation.

Written by the indexing model from the issue text.