(pipelines): add assumeRole parameter to CodeBuildStep

Description

Adds an assumeRole property to pipelines.CodeBuildStep which takes an iam.Role object, e.g.,

const role = iam.Role.fromRoleArn(this, 'Role', 'arn:aws:iam::123456789012:role/MyExistingRole')

const step = new CodeBuildStep('Test', {
  // ...
  assumeRole: role,
})

such that commands configured in step are executed under role.

Use Case

When we consider a cross-account deployment pipeline, we need to perform actions on the deployed resources from inside the pipeline. For example:

• Run a Lambda to perform a database migration.
• Create Cognito users for integration tests.

Proposed Solution

If an assumeRole parameter is provided to a CodeBuildStep, we need to

1. add a PolicyStatement allowing to assume the role, e.g.,

new PolicyStatement({
  effect: Effect.ALLOW,
  actions: ['sts:AssumeRole'],
  resources: [role.arn],
})

2. assume the role inside the container and change the default AWS profile, e.g.,

aws configure --profile stage set role_arn $AWS_IAM_ROLE
aws configure --profile stage set credential_source EcsContainer
    
export AWS_PROFILE=stage

Other information

The feature is a pragmatic workaround to https://github.com/aws/aws-cdk/issues/9625.

Acknowledge

• I may be able to implement this feature request
• This feature might incur a breaking change