using disableLogs option with a single httpApi fails to provision IamS Role

When using the 'disableLogs' option with a function set up to use httpApi rather than the default 'restApi' (example configuration below), the resulting IAMS role is not created properly. The configuration is generated without any 'Resources'.

A workaround is to define a second 'fake' function which does not have 'disableLogs' option. This allows the role to be correctly generated.

The bug was likely introduced here:
https://github.com/serverless/serverless/pull/8561/files

As you can see by looking at the code, it sort of relies on at least one defined function being able to get past the 'return' here:
https://github.com/serverless/serverless/pull/8561/files#diff-634c192175fa19e078211273e8cec92851e3a2fb117fdf447b6998fa1af1a5cfR104

So if at least 1 function is not set up to 'log' then the policy is attempted to be created with an invalid 'Resource []' node (it should never be empty)

e.g

"PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogStream",
                    "logs:CreateLogGroup"
                  ],
                  "Resource": []
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:PutLogEvents"
                  ],
                  "Resource": []
                }
              ]
            }
          }

I guess the next step would be to convert my provided serverless.yml into a failing test case?

service: my-service
unresolvedVariablesNotificationMode: error
variablesResolutionMode: 20210219

provider:
  name: aws
  runtime: nodejs12.x
  region: ${opt:region}
  deploymentBucket:
    name: ssr-lambda-${opt:region}
  stage: ${opt:stage, self:custom.defaultStage}
  profile: ${self:custom.profiles.${self:provider.stage}}
  memorySize: 1024
  logRetentionInDays: 5
  lambdaHashingVersion: 20201221
  endpointType: REGIONAL
  apiGateway:
    shouldStartNameWithService: true

package:
  defaultStage: dev
  profiles:
    dev: devProfile

functions:
  ssr:
    handler: ./dist/index.handler
    disableLogs: true
    events:
      - httpApi: '*'

Serverless: Packaging service...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading artifacts...
Serverless: Uploading service our-code.zip file to S3 (13.22 MB)...
Serverless: Validating template...
Serverless: Updating Stack...
Serverless: Checking Stack update progress...
....
Serverless: Operation failed!
Serverless: View the full error output: snipped

 Serverless Error ----------------------------------------

  An error occurred: IamRoleLambdaExecution - Policy statement must contain resources. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 29809a22-xxx-4988-a82d-xxxxxxx; Proxy: null).

Installed version

> NODE_ENV=production sls --version

Framework Core: 2.29.0 (local)
Plugin: 4.5.0
SDK: 4.2.0
Components: 3.7.3

The suspected change is in the IAM-role generation path from PR #8561; start there and reproduce the issue with the provided minimal serverless.yml using one httpApi function with disableLogs enabled. Add a regression test for this single-function case and verify that the generated policy has valid resources and deployment no longer fails.