Create CDK Pipeline with our own roles and policies

[EysaN]

Recently, I came across this issue #15649 and I am facing the same problem.

I commented on the issue, but looks like it was long deserted and not active anymore.

You can check my comment there for full details and code snippet.
My final goal is to create a CDK Pipeline with my own roles and polices, so that the resulted CF template mustn't include any IAM elements.
And I couldn't find helpful documentation on this regard.

Have anyone succeeded in doing so or have any advice please?

Appreciated 🙏

[khushail]

@EysaN , this documentation talks about opting out of automatic permission management and creating your own roles. This is also implemented in this sample snippet for reference.. Might be helpful to go through.

[EysaN]

Thank you for your comment @khushail,
unfortunately it is not that easy, this documentation talks about creating your own IAM roles and policies through CDK.

But we have a strict policy which does not allow creating IAM resources in CDK projects. So my final goal is to create a CDK pipeline that does not generate any IAM resources.
I am sure such policy exists in many companies, so there must be a way to meet our goal.

Here is a working MVP which you can test and it is similar to the code snippet you provided

from aws_cdk import Stack
from aws_cdk.pipelines import CodePipeline, CodePipelineSource, ShellStep, CodeBuildOptions


class MyPipeline(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, 'appname-' + construct_id + '-pipeline', env=kwargs.get('env'))
        cdk_pipeline_role = iam.Role.from_role_arn(
            self, "cdk_pipeline_role",
            role_arn='role_arn',
            mutable=False
        )
        
        artifact_bucket = s3.Bucket.from_bucket_name(self, "cdk-appname", "cdk-appname")
        
        self.pipeline = CodePipeline(
            self, "appname-pipeline",
            artifact_bucket=artifact_bucket,
            pipeline_name="appname-pipeline",
            publish_assets_in_parallel=False,
            role=cdk_pipeline_role,
            self_mutation=False,
            code_build_defaults=CodeBuildOptions(),  # I tried configuring the CodeBuild project here but it made no difference
            synth=ShellStep(
                "Synth",
                input=CodePipelineSource.s3(
                    bucket=artifact_bucket,
                    object_key="appname",
                    role=cdk_pipeline_role
                ),
                install_commands=[
                    "npm install -g aws-cdk",
                    "python3 -m pip install -r requirements.txt",
                    "python3 -m pip install -r requirements-dev.txt"
                ],
                commands=[
                    "cdk synth"
                ],
            )
        )