Make the CLI experience of multi-account CDK apps awesome

After all of the issues/PRs for cross-account CodePipelines are delivered (#3208, #3323 , #3387, #3388, #3389 ), we will have a great story for making it very easy to work with cross-account CodePipelines.

However, we also need to make it easy to work with cross-account CDK apps from the perspective of authentication from the command line. Most likely, this will involve a deeper integration with AWS profiles defined in the ~/.aws/credentials / ~/.aws/config files. A possible solution would be to allow passing profile when creating a Stack:

new Stack(app, 'Stack1', {
  env: {
     profile: 'account1',
  },
});

The ideal customer experience we want here is to be able to say:

$ cdk deploy '*'

, and all of the different credentials for the different accounts the Stacks belong to will be automatically wired together.

[eladb]

I am curious what people think about this idea which came up as part of the CI/Cd design: My current thinking is that when you bootstrap an environment using the cdk you will be able to specify a trusted account that will be able to deploy into this environment and then the cli will just assume a role in the target and deploy into it. No profiles needed…

[pcgeek86]

It would be great if we could specify an IAM Role to assume in the Environment object.

Example

from aws_cdk.core import App, Environment
from awscdktest.awscdktest_stack import AwscdktestStack

env = Environment(region="us-west-2", assume_role='arn:aws:iam:us-west-2:000000000000:rolename')
app = App()
AwscdktestStack(app, "awscdktest", env=env)
app.synth()