CdkPipeline: How to use existing service roles for code pipeline actions

❓ General Issue

The Question

Is there a way to override the generated pipeline service roles with existing roles? CdkPipeline creates a bunch of roles below which are used by the CodePipeline:

• codepipelineBuildSynthCodePipelineActionRole
• codepipelineUpdatePipelineSelfMutateCodePipelineActionRole
• codepipelineBuildSynthCdkBuildProjectRole
• etc.

I am wondering if there is a way to override these, because I need to use a pre-existing service role created by our security team instead. These generated roles are missing the required permissions to assume the stack synthesizer roles.

Sample code:

        const pipeline = new cdkp.CdkPipeline(this, 'cdk_pipeline', {
            selfMutating: true,

            codePipeline: new codepipeline.Pipeline(this, 'code_pipeline', {
                pipelineName: pipelineConfiguration.stackName,
                role: cicdRole,
                artifactBucket: existingEncryptedBucket,
            }),

            cloudAssemblyArtifact: cloudAssemblyArtifact,
            sourceAction: sourceAction,
            synthAction: cdkp.SimpleSynthAction.standardNpmSynth({
                environment: {
                    privileged: true
                },
                subdirectory: 'iac/cdk',
                sourceArtifact: sourceOutput,
                cloudAssemblyArtifact: cloudAssemblyArtifact,
                installCommand: 'npm ci'
            })
        })

Environment

• CDK CLI Version: 1.110.0
• Module Version: 1.110.0

Referring to the service role here:

[otaviomacedo]

The role codepipelineBuildSynthCdkBuildProjectRole is generated by the SimpleSynthAction. If you are rolling your own action and overriding the role, you don’t have to worry about it. Are there others blocking you?

You can also override the owner in ActionProperties. Make sure you set it to "AWS".

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.