Dang, I just discovered that AWS CDK creates a role for a REST API with the AmazonAPIGatewayPushToCloudWatchLogs policy, but it never cleans it up when the stack is destroyed. That's why today I could not created new stacks on the CI account. Response: 1578078992174923776
