(aws-cdk/pipelines): allow use of custom role for CodePipeline #18167
Description
What is the problem?
When creating pipelines.CodePipeline with a synth pipelines.CodeBuild and even passing in role=role.without_policy_updates() parameter to the CodeBuildStep, the resulting Cfn template is generated with a PipelineRoleDefaultPolicy that exceeds the allowable size. According to other issues and to the docs regarding opting out of policy updates the policy is still being updated.
Reproduction Steps
install_commands = ['npm install -g aws-cdk', 'pip install -r requirements.txt', 'cdk synth']
role = iam.Role(
self,
"Role",
assumed_by=iam.CompositePrincipal(
iam.ServicePrincipal("codepipeline.amazonaws.com"),
iam.ServicePrincipal("codebuild.amazonaws.com"),
),
description="My Custom Role"
)
policy_statement = iam.PolicyStatement(
actions=[
"s3:GetObject*",
"s3:GetBucket*",
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:Abort*",
],
effect=iam.Effect.ALLOW,
resources=[
"*"
],
)
role.add_to_policy(
policy_statement,
)
synth = pipelines.CodeBuildStep(
"Synth",
role=role.without_policy_updates(),
commands=install_commands,
input=pipelines.CodePipelineSource.connection(
"blah/blahblah",
"master",
connection_arn=connection_arn,
),
)
pipeline = pipelines.CodePipeline(
self,
"Pipeline",
synth=synth,
)What did you expect to happen?
the passed in role should not be updated
What actually happened?
policy for passed in role is updated to include individual assets for resources. It's also possible that the roles between the CodeBuildStep and the pipelines.CodePipeline are completely separate in which case I would expect that the pipelines.CodePipelines to allow for a role parameter but this does not appear to be the case.
CDK CLI Version
1.137.0
Framework Version
No response
Node.js Version
v14.18.1
OS
Linux/Ubuntu 20.04
Language
Python
Language Version
3.8.10
Other information
No response