cdklabs / cdklabs/cdk-pipelines-github
Use separate GHA roles per stage
- Dominant language
- TypeScript
- Stars
- 384
- Forks
- 45
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 4
Description
I would like to use a slightly different authentication pattern where each stage uses its own GHA role. The current configuration appears to only support a single role for the whole pipeline, which is then used to assume the CDK role for upload/deployment.
Would it be possible to modify the stage configuration `pipeline.addStageWithGitHubOptions()` to support a separate role per stage? Would you be open to accepting a PR which does this?
Background:
The reason for this request is that with a single role, it seems like we would need to either:
1. Have one stage account designated as the 'pipeline' account, which contains the GHA role and then have the other accounts setup with `cdk bootstrap` to trust it. **OR**
2. Have a completely separate `pipeline` account to contain the GHA role which is trusted by the stage accounts.
The above change, to support a role per stage, would make the configuration closer to the cdk pattern, where we 'bootstrap' the accounts first, to create the roles, with no need for an additional account, or mixing 'pipeline' and 'stage' accounts.
Contributor guide
Assessment
This issue has not been assessed yet.