Describe the feature

Provide the ability to add session tags when assuming the CDK IAM Roles.

Use Case

Our team uses a central S3 bucket where all assets are uploaded for CloudFormation to use, as we have a lot of accounts and managing per-account/per-region buckets would be less than ideal. In order to prevent pipeline builds from accidentally overwriting assets uploaded by another, we use bucket policies to restrict the bucket prefix that any given session created by CI/CD server has access to. That way the CI/CD server must use the correct session tag to be granted access to prefix where the assets are uploaded. For example, here is what a simplified statement in the bucket policy looks like:

    {
      "Sid": "AllowReadWriteCrossAccountViaPrincipalTag",
      "Effect": "Allow",  
      "Principal": "*",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],  
      "Resource": "arn:aws:s3:::bucketName/us-east-1/${aws:PrincipalTag/serverId:uniqueId}/*",
      "Condition": {
        "StringLike": {      
          "aws:arn": [
            "arn:aws:sts::<account-id>:assumed-role/cicd-role/*",
           ]
        }
      }
    }

We would like to be able to follow this same access pattern when CDK uploads assets to the S3 bucket from our pipeline; however, there does not seem to be any way to configure session tags when using the DefaultStackSynthesizer.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.78.0 (build 8e95c37)

Environment details (OS name and version, etc.)

MacOS Ventura 13.4.1 (22F82)