Is there any way to use a single role when deploying with AWS CDK V2 ? Just as it was with V1

user_12684305 0
Viewed 426

I am trying to upgrade my company projects to CDK V2 from CDK V1.

I'm facing problems when deploying to CloudFormation due to my company having strict rules on IAM roles and naming conventions.

Everything worked fine with CDK V1 considering a single role was enough to construct and deploy everything to CloudFormation.

With CDK V2, it is now necessary to create, via bootstrap (I did it by hand due to those constraints but no issue here), different IAM roles and use them with StackSynthesizer.

The problem is: those roles cannot assume in any way, without breaking my company rules, the right iam:PassRole. When my role "deploy" tries to allow my role "cfn-exec" to put everything on CloudFormation, I get an error.

So, is there any way, with CDK V2, to bypass iam:PassRole while using a single role in every "cdk deploy" steps ? Just as it was with CDK V1.

Please be aware that putting a single role in every StackSynthesizer property does not bypass iam:PassRole default behavior.

amazon-iam aws-cdk amazon-web-services
1 Answers

There are a couple of synthesizer options that don't use the usual modern bootstrapping roles.

  1. LegacyStackSynthesizer

This synthesizer will generate CloudFormation parameters for every referenced asset, and use the CLI's current credentials to deploy the stack.

  1. CliCredentialsStackSynthesizer (Preferred)

A synthesizer that uses conventional asset locations, but not conventional deployment roles.

Instead of assuming the bootstrapped deployment roles, all stack operations will be performed using the CLI's current credentials.

Option 2 should work for your use-case.

user_104185150
Related