(core): CDK deploy role does not honor CloudFormation execution role command line option
- Dominant language
- TypeScript
- Stars
- 105
- Forks
- 122
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 71
Description
### Describe the bug
If you bootstrap cdk, and then try to deploy with a different CloudFormation execution role, it doesn't work. See also #19672. You'll get an AccessDenied because the deploy role doesn't have `iam:PassRole` on the execution role you've specified.
### Expected Behavior
It deploys.
### Current Behavior
`cdk deploy -r arn:aws:iam::570774169190:role/test1234`
```
CdkTestingFolderStack failed: AccessDenied: User:
arn:aws:sts::570774169190:assumed-role/cdk-hnb659fds-deploy-role-570774169190-us-east-1/aws-cdk-node is not
authorized to perform: iam:PassRole on resource: arn:aws:iam::570774169190:role/test1234 because no
identity-based policy allows the iam:PassRole action
```
### Reproduction Steps
1. `cdk init sample-app`
2. `cdk bootstrap`
3. Create and deploy CF exec template
```js
cat < template.yml
AWSTemplateFormatVersion: 2010-09-09
Description: "CI CD pipeline"
Resources:
CdkAdminRole:
Type: "AWS::IAM::Role"
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service: "cloudformation.amazonaws.com"
Action:
- "sts:AssumeRole"
ManagedPolicyArns:
- "arn:aws:iam::aws:policy/AdministratorAccess"
Policies:
- PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: CdkAdminPassRole
Effect: Allow
Action:
- "iam:PassRole"
- "iam:GetRole"
Resource: "*"
PolicyName: PassRolePolicy
EOF
```
4. `aws cloudformation deploy --template-file template.yml --stack-name CFExecRoleTest`
5. `cdk deploy -r ""`
FAIL!
### Possible Solution
If I go into the CDK deployrole and edit the `iam:PassRole` parameter for my CF execution role, the stack deploys.
### Additional Information/Context
_No response_
### CDK CLI Version
2.24.1
### Framework Version
_No response_
### Node.js Version
v16.14.2
### OS
Docker Container (Debian 11)
### Language
Typescript
### Language Version
~3.9.7
### Other information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.