AWS CDK Bootstrap custom trust relationship policy for roles

Viewed 2952

I have bootstrapped CDK toolkit stack in this way

npx cdk bootstrap \
--trust 158******206 \
--toolkit-stack-name **** \
--qualifier ****\
--cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess \

As a result, CDK toolkit stack has these resources:

ContainerAssetsRepository

DeploymentActionRole

FileAssetsBucketEncryptionKey

FileAssetsBucketEncryptionKeyAlias

FilePublishingRole

FilePublishingRoleDefaultPolicy

ImagePublishingRole

ImagePublishingRoleDefaultPolicy

StagingBucket

StagingBucketPolicy

Then I try to deploy CDK stack via IAM user and it's work correctly. I use this command:

cdk deploy --require-approval never --toolkit-stack-name **** --profile user-1

If I try deploy via STS I received this error

Error: Could not assume role in target account (did you bootstrap the environment with the right '--trust's?): User: arn:aws:sts::448*****770:assumed-role/cdktoolkit-test-role/91cb8d5a-57e9-4d73-9f66-ddc630b637f2 is not authorized to perform: sts:TagSession on resource: arn:aws:iam::448*****770:role/cdk-event-proc-deploy-role-448******770-us-east-1

My iam-sts-config.yml

---
aws_iam:
  - type: sts-access-keys
    version: V2
    config:
      iam_assume_role_name: cdktoolkit-test-role

Then I add

AWS_ACCESS_KEY_ID=***
AWS_SECRET_ACCESS_KEY=***
AWS_SESSION_TOKEN=***
AWS_DEFAULT_REGION=***

There is my trust relationship policy for the role cdk-event-proc-deploy-role:

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::448******770:root"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::158*****206:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

If I edit and add manually "Action": "sts:TagSession" in to trust relationship policy. I can deploy my stack.

So, my question is, could I set up a custom trust relationship policy when I bootstrap CDK toolkit stack for my roles?

I found only this parameter --trust but it's added only a new Principal could I add additional Actions?

0 Answers
Related