cdk Bootstrap 29 denies assume role calls using external ids

[jcdelc-veho]

Hi team!

Currently, we have faced some issues while implementing the bootstrapping of our aws accounts using the version 29 of the template provided by AWS.

Specifically, the new template denies all the assume role on the CDK roles when an external id is provided Code Reference, but the github pipeline adds it automatically, and doesn't provide any mechanism to avoid setting it up Code Reference

I'm opening this issue to ask for a solution that allows the consumer of this package to avoid setting up such property, in order to consume the new bootstrap configuration without issues.

Thanks!

[AlJohri]

As a temporary work around, folks can run cdk bootstrap --deny-external-id false to disable this feature of the CDK Bootstrap stacks.

Would also be interested to understand a more official solution given "By default, CDK Bootstrap roles are not designed to be deputized".