Run CDK using only existing roles (i.e. not the bootstrap created ones)

[jonchines]

I have a situation where our QA and Prod environments are air-gapped and very tightly controlled. We are not allowed to add or remove roles or policies. Being new to the organization and its polices, my team developed a sizable "big bang" style deployment for a multi-node, n-tier enterprise application closely following WAF in CDK (using TypeScript, if that matters) in our development environment where we have more flexibility. Now we are being told that we may not be able to deploy in the QA and Prod without rework to exclude these new roles. Now, we have some existing Operations Management roles that have enough rights (policy allowance) to run the code we have developed.

a. Can we bootstrap forcing the use of existing roles
b. Is our only other option to cdk synth STACK > file.yml and then find/replace all the roles, vpc's, subnets, etc. (basically "template Cfn off a development account)
c. If we do this, is cdk deploy still an option (I assume not). If not, then I guess we would need to use AWS CLIv2 to load the Cfn manually (or script a wrapper, at the least).