(drift): cdk drift doesn't work with multi-account applications
- Dominant language
- TypeScript
- Stars
- 105
- Forks
- 122
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 71
Description
### Describe the bug
Hello 👋🏼
The `cdk drift` command can't be run against applications that deploy stacks across multiple AWS accounts.
We have a single CDK application where we define hundreds of stacks and deploy them across different AWS accounts from a centralised place. When we run `cdk deploy` or `cdk diff`, we use a single set of credentials, and the CDK automatically assumes `cdk-{qualifier}-*` roles within target accounts.
We want to use `cdk drift` the same way, without needing to manually assume roles ourselves.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
`cdk drift` first assumes a role in the target account, and only then runs drift detection
### Current Behavior
We receive the following error: `Need to perform AWS calls for account 111111111111, but the current credentials are for 222222222222`
### Reproduction Steps
1. Create an application that deploys stacks across multiple AWS accounts
2. Run `cdk drift`
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.186.0
### AWS CDK CLI version
2.1020.2
### Node.js Version
v22.14.0
### OS
MacOS 18
### Language
Python
### Language Version
3.12
### Other information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.