I want to create a policy to SRE so that SRE can create/delete the roles that the name are trail*, ando also the role is only trusted by cloudtrail.

Which means SRE COULD NOT create a role that trust anything but just cloudtrail to assume. For more precisely showing what I mean, the trusted eneity of the role just like the following:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

My Policy statement:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::123456789012:role/trail*",
                "arn:aws:iam::123456789012:role/service-role/trail*"
            ],
            "Condition": {
                "StringEquals": {
                    "sts:AWSServiceName": [
                        "cloudtrail.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreatePolicy",
                "iam:DeletePolicy"
            ],
            "Resource": [
                "arn:aws:iam::123456789012:policy/service-role/Cloudtrail-CW-access-policy-*"
            ]
        }
    ]
}

After creating the policy and attaching it to sre, sre still can not delete trail22(Role Name)

the error message is like:

Failed deleting role trail22.
User: arn:aws:iam::123456789012:user/sre is not authorized to perform: iam:DetachRolePolicy on resource: role trail22 because no identity-based policy allows the iam:DetachRolePolicy action