feat(sns-subscriptions): throw ValidationErrors instead of untyped errors (#34436)

### Issue

Relates to #32569

### Reason for this change

untyped Errors are not recommended

### Description of changes

`ValidationError`s everywhere

### Describe any new or updated permissions being added

None

### Description of how you validated changes

Existing tests. Exemptions granted as this is a refactor of existing code.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: mrgrain

packages/aws-cdk-lib/.eslintrc.js

@@ -30,7 +30,6 @@ const noThrowDefaultErrorNotYetSupported = [
   'aws-scheduler',
   'aws-secretsmanager',
   'aws-servicecatalog',
-  'aws-sns-subscriptions',
   'core',
   'custom-resources',
   'region-info',

packages/aws-cdk-lib/aws-sns-subscriptions/lib/lambda.ts

@@ -3,7 +3,7 @@ import { SubscriptionProps } from './subscription';
 import * as iam from '../../aws-iam';
 import * as lambda from '../../aws-lambda';
 import * as sns from '../../aws-sns';
-import { ArnFormat, Names, Stack, Token } from '../../core';
+import { ArnFormat, Names, Stack, Token, ValidationError } from '../../core';
 
 /**
  * Properties for a Lambda subscription
@@ -25,7 +25,7 @@ export class LambdaSubscription implements sns.ITopicSubscription {
     // Create subscription under *consuming* construct to make sure it ends up
     // in the correct stack in cases of cross-stack subscriptions.
     if (!Construct.isConstruct(this.fn)) {
-      throw new Error('The supplied lambda Function object must be an instance of Construct');
+      throw new ValidationError('The supplied lambda Function object must be an instance of Construct', topic);
     }
 
     this.fn.addPermission(`AllowInvoke:${Names.nodeUniqueId(topic.node)}`, {

packages/aws-cdk-lib/aws-sns-subscriptions/lib/sqs.ts

@@ -3,7 +3,7 @@ import { SubscriptionProps } from './subscription';
 import * as iam from '../../aws-iam';
 import * as sns from '../../aws-sns';
 import * as sqs from '../../aws-sqs';
-import { ArnFormat, FeatureFlags, Names, Stack, Token } from '../../core';
+import { ArnFormat, FeatureFlags, Names, Stack, Token, ValidationError } from '../../core';
 import * as cxapi from '../../cx-api';
 
 /**
@@ -34,20 +34,20 @@ export class SqsSubscription implements sns.ITopicSubscription {
     // Create subscription under *consuming* construct to make sure it ends up
     // in the correct stack in cases of cross-stack subscriptions.
     if (!Construct.isConstruct(this.queue)) {
-      throw new Error('The supplied Queue object must be an instance of Construct');
+      throw new ValidationError('The supplied Queue object must be an instance of Construct', topic);
     }
     const snsServicePrincipal = new iam.ServicePrincipal('sns.amazonaws.com');
 
     // if the queue is encrypted by AWS managed KMS key (alias/aws/sqs),
     // throw error message
     if (this.queue.encryptionType === sqs.QueueEncryption.KMS_MANAGED) {
-      throw new Error('SQS queue encrypted by AWS managed KMS key cannot be used as SNS subscription');
+      throw new ValidationError('SQS queue encrypted by AWS managed KMS key cannot be used as SNS subscription', topic);
     }
 
     // if the dead-letter queue is encrypted by AWS managed KMS key (alias/aws/sqs),
     // throw error message
     if (this.props.deadLetterQueue && this.props.deadLetterQueue.encryptionType === sqs.QueueEncryption.KMS_MANAGED) {
-      throw new Error('SQS queue encrypted by AWS managed KMS key cannot be used as dead-letter queue');
+      throw new ValidationError('SQS queue encrypted by AWS managed KMS key cannot be used as dead-letter queue', topic);
     }
 
     // add a statement to the queue resource policy which allows this topic

packages/aws-cdk-lib/aws-sns-subscriptions/lib/url.ts

@@ -1,6 +1,6 @@
 import { SubscriptionProps } from './subscription';
 import * as sns from '../../aws-sns';
-import { Token } from '../../core';
+import { Token, UnscopedValidationError } from '../../core';
 
 /**
  * Options for URL subscriptions.
@@ -49,11 +49,11 @@ export class UrlSubscription implements sns.ITopicSubscription {
   constructor(private readonly url: string, private readonly props: UrlSubscriptionProps = {}) {
     this.unresolvedUrl = Token.isUnresolved(url);
     if (!this.unresolvedUrl && !url.startsWith('http://') && !url.startsWith('https://')) {
-      throw new Error('URL must start with either http:// or https://');
+      throw new UnscopedValidationError('URL must start with either http:// or https://');
     }
 
     if (this.unresolvedUrl && props.protocol === undefined) {
-      throw new Error('Must provide protocol if url is unresolved');
+      throw new UnscopedValidationError('Must provide protocol if url is unresolved');
     }
 
     if (this.unresolvedUrl) {