Issue # (if applicable)

Closes #30686.

Reason for this change

My use case involves publishing a lambda layer consumed by a library. Users may be on different library versions, meaning they may be on different layer versions. These users need to be able to access the layer from different accounts across my organization.

At first I added resource permissions to the layer by calling ILayerVersion.addPermission(). However I noticed that when new layers were published, old layers lost their resource permissions. I confirmed this with the cli: aws lambda get-layer-version-policy --layer-name ... --version-number ....

Looking at the I was able to fix the behavior by manually constructing the CfnLayerVersionPermission instead of using the top level addPermission() function:

    const orgPermission = new CfnLayerVersionPermission(this, "qualtricsOrgPermissionAmd64", {
      action: 'lambda:GetLayerVersion',
      layerVersionArn: lambdaLayer.layerVersionArn,
      principal: '*',
      organizationId: constants.ORG_ID,
    });
    orgPermission.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);

This added "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" to the cloud formation template (according to this documentation, both are required). That fixed my issue but it's an ugly solution that was difficult to come up with. I'd like to be able to use addPermission()

Description of changes

I changed LayerVersionPermission to take a optional RemovalPolicy.

Description of how you validated changes

Easy to validate with unit tests

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license