(CdkPipeline): CdkPipeline source stage fails in a cross account setup #14156
Description
CDKPipeline fails to clone repository that exists in a different AWS Account.
Reproduction Steps
Sample: https://github.com/ganeshnj/cdk-pipeline-cross-account-sample
- synth & deploy
npx cdk bootstrap --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess aws://{pipeline-account-id}/us-west-2
npx cdk bootstrap --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess --trust {pipeline-account-id} aws://{source-account-id}/us-west-2 --profile source
cdk synth
cdk deploy --all
- Branch not found issue
The action failed because no branch named main was found in the selected AWS CodeCommit repository MyRepository. Make sure you are using the correct branch name, and then try again. Error: null
-
Go to the source AWS account and create a
mainbranch. -
Try again source stage.
-
Permissions issue
The service role or action role doesn’t have the permissions required to access the Amazon S3 bucket named {bucket-name}. Update the IAM role permissions, and then try again. Error: Amazon S3:AccessDenied:Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: {Request ID}; S3 Extended Request ID: {Extended Request ID}; Proxy: null)
What did you expect to happen?
Source stage should succeed
What actually happened?
Source stage failed with permission error.
Environment
- CDK CLI Version : 1.98.0 (build 79f4512)
- Framework Version:
- Node.js Version: v12.18.4
- OS : Windows 10
- Language (Version): C#
Other
This is 🐛 Bug Report