Describe the bug

When trying to come up with a workaround for the maximum policy size bug mentioned here and elsewhere, I created my own IAM role to explicitly pass in to my Pipelines.

As soon as I did this, the cross-region support stacks for my Pipelines were changed slightly; their KMS KeyPolicy got a new PolicyStatement that looks like this:

            {
              "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:GenerateDataKey*",
                "kms:ReEncrypt*"
              ],
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::123456789012:role/my-new-pipeline-role"
                    ]
                  ]
                }
              },
              "Resource": "*"
            },

The policy now explicitly references the new IAM role that I created for my Pipeline.

However, that role does not exist until the Pipeline stack itself is deployed, and the order of the actions created by CodePipeline attempts to deploy the support stacks first. So the support stacks fail to deploy because this IAM role does not exist yet.

Expected Behavior

Explicitly passing in an IAM role to the constructor of my Pipelines will allow me to avoid the maximum IAM policy size bugs, while still deploying my Pipeline stacks and support stacks.

Current Behavior

The support stacks fail to deploy with Resource handler returned message: "Policy contains a statement with one or more invalid principals. (Service: Kms, Status Code: 400, Request ID: ..., Extended Request ID: null)" (RequestToken: ..., HandlerErrorCode: InvalidRequest), because they reference an IAM role arn that has not been created yet.

Reproduction Steps

Create an IAM role, pass it in to the constructor of a Pipeline object, observe that the support stacks that are generated now explicitly reference the ARN of this IAM role in their KeyPolicy.

Possible Solution

Do not add the Role to the KeyPolicy. It is unnecessary, as the Role is in the same account as the Key, and the KeyPolicy already grants permission to the account:

            {
              "Action": "kms:*",
              "Effect": "Allow",
              "Principal": {
                "AWS": {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":iam::123456789012:root"
                    ]
                  ]
                }
              },
              "Resource": "*"
            },

Additional Information/Context

No response

CDK CLI Version

2.19.0

Framework Version

2.19.0

Node.js Version

v16.5.0

OS

Amazon Linux 2

Language

Typescript

Language Version

TypeScript 4.4.2

Other information

No response