cdklabs / cdklabs/cdk-pipelines-github
Would it be possible to specify the CFN Execution Role?
- Dominant language
- TypeScript
- Stars
- 384
- Forks
- 45
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 4
Description
The current GithubWorkflow design assumes that the CFN Execution Role that was [defined in the CDK Bootstrap][1] will be assumed during the Deployment. However, this is quite problematic for organizations that desire to use CDK AND not grant ALL CDK apps the exact same permissions. E.g., `AdministratorAccess` is just to much power to be granted. In fact this is one of the reasons that the CDK deploy allows the CFN Execution Role to be specified. See the `--role-arn` option for cdk deploy.
Could this be addressed in the GithubWorkflow design?
Or perhaps I've misunderstood the current design? Or missed the option where this could be specified?
[1]: https://github.com/aws/aws-cdk/blob/c5a96793818f57141efc78ab60f13b48a3b1e460/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L482-L503
Contributor guide
Assessment
This issue has not been assessed yet.