aws / aws/aws-cdk

(pipelines): Remove additional IAM Role generated from ManualApprovalStep

Open
#36,597 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam effort/medium feature-request p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

`ManualApprovalStep` defaults to using the role assigned to `CodePipeline` rather than creating additional roles and policies that go unused.

### Use Case

Internal tooling has identified that the IAM role generated for `ManualApprovalStep` are never assumed. These roles provide no behavior beyond being able to assumed by account root.

During security and best practice audits, account owners are regularly encouraged to remove unnecessary IAM roles to shrink various surface areas and access routes into accounts. While this IAM Role is fairly harmless, a new one is created for every Manual Approval step and creates a lot of noise.

### Proposed Solution

The underlying `ManualApprovalAction` from `aws-codepipeline-actions` already permits passing in a role as a prop.

When using it with the `aws-codepipeline` module, the stack successfully synthesizes, so should be successful when using the `pipelines` module too.

### Other Information

While `usePipelineRoleForActions` is available and can solve this, it's also an escalation of permissions that effects the entire pipeline.

There might be use-cases where the IAM role is generated with a policy and has different permissions/cases than I've reviewed personally.

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.233.0

### AWS CDK CLI version

2.1100.3 (build 0aa3e98)

### Environment details (OS name and version, etc.)

macos 15.7.3

Contributor guide

Open the contributing guide

Research direction

Start by tracing ManualApprovalStep in the pipelines module and compare how ManualApprovalAction receives its role in the aws-codepipeline module. Synthesize a pipeline containing a manual approval step and inspect the generated IAM resources. Done means the unnecessary additional role is absent while existing manual-approval behavior and any explicitly configured permissions remain intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.