Problem

When an AWS::SSO::PermissionSet contains an inline policy, cdk diff renders IAM Statement Changes with an empty Principal column. This makes the diff difficult to interpret, especially when multiple Permission Sets exist in the same stack, because the IAM Statement table does not indicate which Permission Set the statement belongs to.

This issue is reported in #956.

Solution

This PR introduces a minimal and targeted enhancement to the diff engine:
When the inline policy comes from an AWS::SSO::PermissionSet, and the derived principal would otherwise be empty:
The diff engine now assigns a pseudo-principal:

AWS:${<LogicalId>}

This keeps the diff output consistent and readable, letting developers immediately see which Permission Set owns each IAM statement.

All existing behavior for IAM Roles, Users, Policies, Groups, and non-PermissionSet resources is unchanged.

Implementation Details

• Added readPermissionSetInlinePolicy, which:
  -> Parses inline statements,
  -> Applies defaultResource (existing behavior),
  -> Applies defaultPrincipal with a PermissionSet-specific pseudo-principal.
• Updated the InlineResourcePolicy branch in readPropertyChange to route PermissionSet policies through this new helper.
• No changes were made to synthesis or deployment logic.

Tests

Updated PermissionSet-related expectations in
test/iam/detect-changes.test.ts to reflect the new principal.

All IAM change detection tests now validate the presence of the pseudo-principal.

Full test suite executed successfully:
This change affects only the human-readable diff output.
Full test suite executed successfully:

Test Output (All Green)

All suites and tests passed locally after the PermissionSet principal enhancement:
Here is the full output of yarn test from my local environment:

Fixes #956

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license