CodePipeline: CloudFormation ExecuteChangeSet Action doesn't have correct permissions

[joshrp]

Note: for support questions, please first reference our documentation, then use Stackoverflow. This repository's issues are intended for feature requests and bug reports.

• I'm submitting a ...

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior?

pipeline.addStage({
  stageName: "DeployStack",
  actions: [
    new pipeActions.CloudFormationExecuteChangeSetAction({
      actionName: "Deploy",
      stackName: "myStack-" + stage,
      changeSetName: stage + '-deployment',
      output: deployArtifact
    })
  ]
});

The default role for a CloudFormationExecuteChangeSetAction will only be created with cloudformation:ExecuteChangeSet permission. This errors when ran in CodePipeline with a permissions error for the cloudformation:DescribeStacks permission.

See: https://github.com/awslabs/aws-cdk/blob/master/packages/@aws-cdk/aws-codepipeline-actions/lib/cloudformation/pipeline-actions.ts#L121

• What is the expected behavior (or behavior of feature suggested)?
  The ExecuteChangeSet Action Default Role needs cloudformation:DescribeStacks and cloudformation:DescribeChangeSet on the {stack}/* resource to be able to deploy.

• Please tell us about your environment:

  • CDK CLI Version: 0.36.1
  • Module Version: 0.36.1
  • OS: all
  • Language: all

• Other information
  This could be related to the recent change in: feat(codepipeline): generate a Role for every AWS-owned Action used in a Pipeline #3105 since the permission may have been available on the general role.

[skinny85]

Thanks for reporting this @joshrp . Let me try to reproduce on my end.

[skinny85]

Confirmed I was able to reproduce this. Working on a fix.