Lambda stack with imported vpc fails to delete

Deleting a Cloudformation stack containing a VPC Lambda will fail with a dependency error on each Lambda's security group.

This is similar to this issue: https://aws.amazon.com/blogs/compute/update-issue-affecting-hashicorp-terraform-resource-deletions-after-the-vpc-improvements-to-aws-lambda/

### Reproduction Steps

- Import an existing VPC using .fromVpcAttributes and configure a new Lambda function with the VPC. This will create a function with a default security group.
- Deploy the stack
- Delete the stack
- Wait about an hour, and observe the error when the stack fails to delete

### Error Log

`resource sg- has a dependent object (Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; ...)`

### Environment

- **CLI Version :** 1.24.0
- **Framework Version:** 1.24.0
- **OS :** MacOS Catalina
- **Language :** Typescript

### Other

I was able to solve this using the recommended solution in the AWS blog post. The fix for CDK was tricky, so here's my solution:
```typescript
const fixVpcDeletion = (handler: lambda.IFunction): void => {
handler.connections.securityGroups.forEach(sg => {
if (handler.role) {
handler.role.node.children.forEach(child => {
if (
child.node.defaultChild &&
(child.node.defaultChild as iam.CfnPolicy).cfnResourceType === 'AWS::IAM::Policy'
) {
sg.node.addDependency(child);
}
});
}
});
};

fixVpcDeletion(getHandler);
```
*Edit: updated the function since `instanceof` didn't always seem to work.*

---

This is :bug: Bug Report

Start by reproducing the failure with an imported VPC created through fromVpcAttributes and a VPC-connected Lambda, then inspect how the Lambda security group and IAM policy dependencies are synthesized. Compare the deletion order with the AWS blog's recommended solution. Done means the generated stack deletes successfully without a dependency violation.

Written by the indexing model from the issue text.