cdklabs / cdklabs/cdk-pipelines-github
cdk Bootstrap 29 denies assume role calls using external ids
- Dominant language
- TypeScript
- Stars
- 384
- Forks
- 45
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 4
Description
Hi team!
Currently, we have faced some issues while implementing the bootstrapping of our aws accounts using the version 29 of the template provided by AWS.
Specifically, the new template denies all the assume role on the CDK roles when an external id is provided [Code Reference](https://github.com/aws/aws-cdk-cli/blob/e46adaf06467dfed206bddbf295f7f388fd05718/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L59-L70), but the github pipeline adds it automatically, and doesn't provide any mechanism to avoid setting it up [Code Reference](https://github.com/cdklabs/cdk-pipelines-github/blob/bebe6a5e626b838fdb3c479cef8e8ae1c6b08ab6/src/aws-credentials.ts#L131)
I'm opening this issue to ask for a solution that allows the consumer of this package to avoid setting up such property, in order to consume the new bootstrap configuration without issues.
Thanks!
Contributor guide
Assessment
This issue has not been assessed yet.