(cdk): diff ignores --role-arn #634
Description
What is the problem?
cdk --role-arn arn:aws:iam::123:role/xxx diff still tries to assume the default cdk-hnb659fds-deploy-role-123-us-xxx role. We want to use custom limited roles and this limitation means we are forced to give diff users full access to target accounts with the deploy role.
I believe the problem is with this line:
It needs to pass along args.roleArn to prepareSdkFor() just like bootstrap and deploy commands do.
Reproduction Steps
Setup a profile that cannot assume the deploy role, but can assume another role that has access to read stacks (xxx in this example). Use:
cdk --role-arn arn:aws:iam::123:role/xxx diff
What did you expect to happen?
I would expect CDK to assume the role I asked it to assume and successfully print a diff.
What actually happened?
Could not assume role in target account using current credentials (which are for account 123) User: arn:aws:sts::123:assumed-role/instance-role/i-123 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123:role/cdk-hnb659fds-deploy-role-123-us-west-2 . Please make sure that this role exists in the account. If it doesn't exist, (re)-bootstrap the environment with the right '--trust', using the latest version of the CDK CLI.
CDK CLI Version
1.129.0
Framework Version
1.121.0
Node.js Version
16.12.0
OS
macOS Big Sur
Language
Python
Language Version
3.8
Other information
Also reported on StackOverflow https://stackoverflow.com/questions/68422581/cdk-diff-with-read-only-permissions-what-is-a-good-way