aws / aws/aws-cdk-cli

(core): CDK deploy role does not honor CloudFormation execution role command line option

Open
#1,449 2 comments 2 reactions 0 assignees View on GitHub
effort/medium p2
Dominant language
TypeScript
Stars
105
Forks
122
Avg merge
1d 17h
Merged PRs (30d)
71

Description

### Describe the bug

If you bootstrap cdk, and then try to deploy with a different CloudFormation execution role, it doesn't work. See also #19672. You'll get an AccessDenied because the deploy role doesn't have `iam:PassRole` on the execution role you've specified.

### Expected Behavior

It deploys.

### Current Behavior

`cdk deploy -r arn:aws:iam::570774169190:role/test1234`

```
CdkTestingFolderStack failed: AccessDenied: User:
arn:aws:sts::570774169190:assumed-role/cdk-hnb659fds-deploy-role-570774169190-us-east-1/aws-cdk-node is not
authorized to perform: iam:PassRole on resource: arn:aws:iam::570774169190:role/test1234 because no
identity-based policy allows the iam:PassRole action
```

### Reproduction Steps

1. `cdk init sample-app`
2. `cdk bootstrap`
3. Create and deploy CF exec template
```js
cat < template.yml
AWSTemplateFormatVersion: 2010-09-09
Description: "CI CD pipeline"
Resources:
CdkAdminRole:
Type: "AWS::IAM::Role"
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service: "cloudformation.amazonaws.com"
Action:
- "sts:AssumeRole"
ManagedPolicyArns:
- "arn:aws:iam::aws:policy/AdministratorAccess"
Policies:
- PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: CdkAdminPassRole
Effect: Allow
Action:
- "iam:PassRole"
- "iam:GetRole"
Resource: "*"
PolicyName: PassRolePolicy
EOF
```
4. `aws cloudformation deploy --template-file template.yml --stack-name CFExecRoleTest`
5. `cdk deploy -r ""`

FAIL!

### Possible Solution

If I go into the CDK deployrole and edit the `iam:PassRole` parameter for my CF execution role, the stack deploys.

### Additional Information/Context

_No response_

### CDK CLI Version

2.24.1

### Framework Version

_No response_

### Node.js Version

v16.14.2

### OS

Docker Container (Debian 11)

### Language

Typescript

### Language Version

~3.9.7

### Other information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.