AWS CDK Pipeline Cross Account Role

aws-cdk-pipeline-role.js

// PipelinePrepStack in the Tools Account ===================

// Base Role for pipelines. Created here as it is required outside of the pipeline stack for cross-region deployments.
const pipelineBaseRole = new Role(this, 'pipelineBaseRole', {
    assumedBy: new ServicePrincipal('codepipeline.amazonaws.com'),
    roleName: codeCommitAccessRoleName, // We use this fixed name to attach the role in the pipeline stack
    description: 'Role used by CodePipelines to allow for cross-account deployments',
});
pipelineBaseRole.addToPolicy(new PolicyStatement({
    sid: 'AssumeRoles',
    effect: Effect.ALLOW,
    actions: [
        'sts:AssumeRole',
    ],
    resources: [
        // Roles that the Pipelines will need to assume during source, build and deploy.
        // The resource Arn's are created using params that are shared with the Pipeline stacks, so we have predictable Arn's.

        // Destination accounts CDK deploy role
        `arn:aws:iam::*:role/cdk-${cdkBootstrapQualifier}-deploy-role-*`,

        // Helper stacks in the pipeline account
        `arn:aws:iam::${this.account}:role/${pipelineName}*`,

        // All of the CodeBuild assets roles required by the pipeline
        // 'pipelineBaseResourceName' is used in:
        // const pipelineBase = new Pipeline(this, pipelineBaseResourceName, {})
        // 'pipelineResourceName' is used in:
        // new CodePipeline(this, pipelineResourceName, { codePipeline: pipelineBase, ...})
      
        `arn:aws:iam::${this.account}:role/*${pipelineResourceName}Assets*`,
        `arn:aws:iam::${this.account}:role/*${pipelineResourceName}Update*`,
        `arn:aws:iam::${this.account}:role/*${pipelineResourceName}Build*`,
        `arn:aws:iam::${this.account}:role/*${pipelineResourceName}${deployStageResourceName}*`,
        `arn:aws:iam::${this.account}:role/*${pipelineBaseResourceName}Assets*`,
        `arn:aws:iam::${this.account}:role/*${pipelineBaseResourceName}Update*`,
        `arn:aws:iam::${this.account}:role/*${pipelineBaseResourceName}Build*`,
        `arn:aws:iam::${this.account}:role/*${pipelineBaseResourceName}${deployStageResourceName}*`,

        // The helper role created by CDK Pipelines in the CodeCommit Account (CDK creates this role in lowercase only)
        // 'stackNamePrefix' is used to create the Pipeline stack names
        `arn:aws:iam::${codeCommitAccount}:role/${stackNamePrefix.toLowerCase()}*`,
    ],
}));