cdklabs / cdklabs/cdk-pipelines-github

Would it be possible to specify the CFN Execution Role?

Open
#154 1 comment 0 reactions 0 assignees View on GitHub
effort-small feature-request p2
Dominant language
TypeScript
Stars
384
Forks
45
Avg merge
1d 1h
Merged PRs (30d)
4

Description

The current GithubWorkflow design assumes that the CFN Execution Role that was [defined in the CDK Bootstrap][1] will be assumed during the Deployment. However, this is quite problematic for organizations that desire to use CDK AND not grant ALL CDK apps the exact same permissions. E.g., `AdministratorAccess` is just to much power to be granted. In fact this is one of the reasons that the CDK deploy allows the CFN Execution Role to be specified. See the `--role-arn` option for cdk deploy.

Could this be addressed in the GithubWorkflow design?

Or perhaps I've misunderstood the current design? Or missed the option where this could be specified?

[1]: https://github.com/aws/aws-cdk/blob/c5a96793818f57141efc78ab60f13b48a3b1e460/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L482-L503

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.