app-staging-synthesizer: cross-account support
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
I do not see an option to add a trust relationship to the roles created by the new app-staging-synthsizer.
But they are required to provide a similar experience as the current default bootstrap for cross-account deployments.
### Use Case
We have three accounts: dev, prod and one for the pipeline
### Proposed Solution
I think adding an array of trusted accounts to https://github.com/aws/aws-cdk/blob/a35fcc59b227cc6151c50ebd04a7b9f9fb3bc189/packages/%40aws-cdk/app-staging-synthesizer-alpha/lib/default-staging-stack.ts#L45 might work. `IPrincipal[]` could be used.
Then adding a `CompositePrincipal` with the account and the added trusted accounts should be enough.
### Other Information
_No response_
### Acknowledgements
- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
-
### Environment details (OS name and version, etc.)
-
Contributor guide
Research direction
Start with packages/@aws-cdk/app-staging-synthesizer-alpha/lib/default-staging-stack.ts at the referenced role definition, then compare it with the current default bootstrap’s cross-account behavior. Determine how trusted accounts should be exposed and represented in the generated roles; done means deployments across the dev, prod, and pipeline accounts receive the required trust relationship.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100