Does anyone know how to pass a service linked role (autoscaling role with a suffix) to an autoscaling group by using CDK/CloudFormation?
I have managed to grant the default autoscaling service role access to a CMK living in another account. However, I don't want all autoscaling groups having the default role to have access to the key.
I assume that the best solution is to bootstrap the service linked role and grant it CMK access, but how do I pass the role? (This is not the instance assumable role)