aws/aws-cdk
Voir sur GitHub(pipelines): add assumeRole parameter to CodeBuildStep
Open
#18 272 ouverte le 5 janv. 2022
@aws-cdk/pipelineseffort/smallfeature-requestgood first issuep2
Métriques du dépôt
- Stars
- (10 710 stars)
- Métriques de merge PR
- (Merge moyen 14j 11h) (68 PRs mergées en 30 j)
Description
Description
Adds an assumeRole property to pipelines.CodeBuildStep which takes an iam.Role object, e.g.,
const role = iam.Role.fromRoleArn(this, 'Role', 'arn:aws:iam::123456789012:role/MyExistingRole')
const step = new CodeBuildStep('Test', {
// ...
assumeRole: role,
})
such that commands configured in step are executed under role.
Use Case
When we consider a cross-account deployment pipeline, we need to perform actions on the deployed resources from inside the pipeline. For example:
- Run a Lambda to perform a database migration.
- Create Cognito users for integration tests.
Proposed Solution
If an assumeRole parameter is provided to a CodeBuildStep, we need to
- add a
PolicyStatementallowing to assume therole, e.g.,
new PolicyStatement({
effect: Effect.ALLOW,
actions: ['sts:AssumeRole'],
resources: [role.arn],
})
- assume the role inside the container and change the default AWS profile, e.g.,
aws configure --profile stage set role_arn $AWS_IAM_ROLE
aws configure --profile stage set credential_source EcsContainer
export AWS_PROFILE=stage
Other information
The feature is a pragmatic workaround to https://github.com/aws/aws-cdk/issues/9625.
Acknowledge
- I may be able to implement this feature request
- This feature might incur a breaking change