(pipelines): Remove additional IAM Role generated from ManualApprovalStep
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
`ManualApprovalStep` defaults to using the role assigned to `CodePipeline` rather than creating additional roles and policies that go unused.
### Use Case
Internal tooling has identified that the IAM role generated for `ManualApprovalStep` are never assumed. These roles provide no behavior beyond being able to assumed by account root.
During security and best practice audits, account owners are regularly encouraged to remove unnecessary IAM roles to shrink various surface areas and access routes into accounts. While this IAM Role is fairly harmless, a new one is created for every Manual Approval step and creates a lot of noise.
### Proposed Solution
The underlying `ManualApprovalAction` from `aws-codepipeline-actions` already permits passing in a role as a prop.
When using it with the `aws-codepipeline` module, the stack successfully synthesizes, so should be successful when using the `pipelines` module too.
### Other Information
While `usePipelineRoleForActions` is available and can solve this, it's also an escalation of permissions that effects the entire pipeline.
There might be use-cases where the IAM role is generated with a policy and has different permissions/cases than I've reviewed personally.
### Acknowledgements
- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### AWS CDK Library version (aws-cdk-lib)
aws-cdk-lib@2.233.0
### AWS CDK CLI version
2.1100.3 (build 0aa3e98)
### Environment details (OS name and version, etc.)
macos 15.7.3
Contributor guide
Research direction
Start by tracing ManualApprovalStep in the pipelines module and compare how ManualApprovalAction receives its role in the aws-codepipeline module. Synthesize a pipeline containing a manual approval step and inspect the generated IAM resources. Done means the unnecessary additional role is absent while existing manual-approval behavior and any explicitly configured permissions remain intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100