(aws-cdk/pipelines): allow use of custom role for CodePipeline

What is the problem?

When creating pipelines.CodePipeline with a synth pipelines.CodeBuild and even passing in role=role.without_policy_updates() parameter to the CodeBuildStep, the resulting Cfn template is generated with a PipelineRoleDefaultPolicy that exceeds the allowable size. According to other issues and to the docs regarding opting out of policy updates the policy is still being updated.

Reproduction Steps

install_commands = ['npm install -g aws-cdk', 'pip install -r requirements.txt', 'cdk synth']
        role = iam.Role(
            self,
            "Role",
            assumed_by=iam.CompositePrincipal(
                iam.ServicePrincipal("codepipeline.amazonaws.com"),
                iam.ServicePrincipal("codebuild.amazonaws.com"),
            ),
            description="My Custom Role"
        )

        policy_statement = iam.PolicyStatement(
            actions=[
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*",
                "s3:DeleteObject*",
                "s3:PutObject",
                "s3:Abort*",
            ],
            effect=iam.Effect.ALLOW,
            resources=[
                "*"
            ],
        )

        role.add_to_policy(
            policy_statement,
        )

        synth = pipelines.CodeBuildStep(
            "Synth",
            role=role.without_policy_updates(),
            commands=install_commands,
            input=pipelines.CodePipelineSource.connection(
                "blah/blahblah",
                "master",
                connection_arn=connection_arn,
            ),
        )

        pipeline = pipelines.CodePipeline(
            self,
            "Pipeline",
            synth=synth,
        )

What did you expect to happen?

the passed in role should not be updated

What actually happened?

policy for passed in role is updated to include individual assets for resources. It’s also possible that the roles between the CodeBuildStep and the pipelines.CodePipeline are completely separate in which case I would expect that the pipelines.CodePipelines to allow for a role parameter but this does not appear to be the case.

CDK CLI Version

1.137.0

Framework Version

No response

Node.js Version

v14.18.1

OS

Linux/Ubuntu 20.04

Language

Python

Language Version

3.8.10

Other information

No response

[saltman424]

This is the PR for this issue: #18293

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.