[pipelines] add custom PolicyStatement to the ShellScriptAction

Hi,

I have used the new pipeline constructs recently and added a custom stage with a ShellScriptAction and custom sam cli commands such as sam package and sam publish. The issue I have encountered is that it is not easy to add custom PolicyStatement to the role, that is associated with the stage. Given the nature of a ShellScriptAction to be generic step in a pipeline running bash commands, it would be great to pass a specific IAM PolicyStatement to a corresponding action role.

I have found a way to do that, but this is not an easy task, this is how it resolved now:

const publishStageNode = this.node?.tryFindChild('Pipeline')?.node.tryFindChild('Pipeline')?.node.tryFindChild('publishStageNode')
publishStageNode?.node.tryFindChild('publishAction')?.node.children?.forEach(item => {
    if (item instanceof PipelineProject) {
        item.addToRolePolicy(allowCreateLayerSererlessRepoPolicy);
        item.addToRolePolicy(allowUploadToS3Policy);
     }
})

As you can see this is not an easy way to fetch the stage and the PipelineProject construct that is nested within the tree. Furthermore, I have to loop through the children, because in some cases there is a Role and a PipelineProject construct.

Proposed Solution

it would be great to add a policy statement directly to an action i.e.:

const policyStatement = new iam.PolicyStatement({...});

const action = new ShellScriptAction({
    actionName: 'mySpecialShellScriptAction',
    commands: [_some_bash_commands_here_]
});

action.addToRolePolicy(policyStatement);

Other

Pinging @webdog as per request.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[brianfoody]

Got it working by creating a role in the testing account and assuming it in my tests from the build account.

[brianfoody]

@am29d @Chriscbr do you know how to do this for cross-account deployments?

I have a build account where the pipeline runs and deploys the stack to a staging account. I want to assume a role in the staging account to execute the acceptance tests on but I’m not sure how to do this with CDK pipelines.