What is the correct way to re-use boostrap deployment roles?

[rupe120]

I am attempting to create a CodePipeline for a fork of the AWS Solution Innovation Sandox on AWS app https://github.com/aws-solutions/innovation-sandbox-on-aws

I am trying to modify that solution as little as possible, while also minimizing the number of resources I create. I created a second CDK repository that builds a CodePipeline to run the npm run deploy:xxx commands. In the Buildspec that I added to the Innovation Sandbox repo I assume the CDK deploy role before each of the 4 deploy run statements.

The problem is when the deployment runs it get the following errors

current credentials could not be used to assume 'arn:aws:iam::96xxx57:role/cdk-hnb659fds-file-publishing-role-96xxx57-us-east-1', but are for the right account. Proceeding anyway.

InnovationSandbox-AccountPool: fail: User: arn:aws:sts::96xxx57:assumed-role/cdk-hnb659fds-deploy-role-96xxx57-us-east-1/CodeBuild-Deploy-AccountPool-1769178658 is not authorized to perform: s3:PutObject on resource: "arn:aws:s3:::cdk-hnb659fds-assets-96xxx57-us-east-1/35658981a4fc9561802559f1251f57680065e5f463cc1cd95d11ca6654216d59.json" because no identity-based policy allows the s3:PutObject action

It seems like I actually need to assume both the File Publishing and the Deployment roles, but you can only assume one role at a time.
Should I just create my own roles to assume? I was just also trying to not create more resources than I need and re-use what CDK bootstrap had already setup.

[MentalOfCrow]

Do not pre-assume the bootstrap deploy role in the buildspec. That is what turns the deployment-role session into the CDK CLI's base credentials and causes the file upload to fall back to the wrong principal.

The modern bootstrap roles are intentionally separated. During one cdk deploy, the CLI uses its original actor credentials to assume, independently:

• the file-publishing role for S3 assets;
• the image-publishing role for ECR assets;
• the deployment role for the CloudFormation operation;
• the lookup role when context lookups are needed.

AWS documents that exact sequence in How AWS CDK deployments work. You do not have to hold two role sessions at once; the CLI obtains the appropriate temporary credentials for each phase.

For a same-account CodeBuild project, the buildspec should therefore be roughly:

phases:
  build:
    commands:
      - aws sts get-caller-identity
      - npm ci
      - npx cdk deploy --all --require-approval never

Let CodeBuild use its normal project service role. Give that role permission to assume the bootstrap roles instead of assuming one of those roles manually:

project.addToRolePolicy(new iam.PolicyStatement({
  actions: ['sts:AssumeRole'],
  resources: [
    `arn:aws:iam::${account}:role/cdk-hnb659fds-deploy-role-${account}-${region}`,
    `arn:aws:iam::${account}:role/cdk-hnb659fds-file-publishing-role-${account}-${region}`,
    `arn:aws:iam::${account}:role/cdk-hnb659fds-image-publishing-role-${account}-${region}`,
    `arn:aws:iam::${account}:role/cdk-hnb659fds-lookup-role-${account}-${region}`,
  ],
}))

The target roles' trust policies must also trust the CodeBuild role/account. In the same account, a modern default bootstrap normally has the account-side trust relationship; in cross-account deployments, re-bootstrap the target with the CI account in --trust (and choose the CloudFormation execution policies deliberately). AWS warns that trusted accounts receive the deployment permissions configured during bootstrap, so do not use a broad trust list casually: CDK bootstrap guidance.

The error sequence in the question is consistent with this diagnosis:

1. the build manually becomes ...deploy-role.../CodeBuild-Deploy-...;
2. CDK cannot assume the file-publishing role from those credentials;
3. because the credentials are in the correct account it proceeds with them;
4. that deploy role correctly lacks direct s3:PutObject on the asset bucket.

Do not fix that by adding asset-bucket writes to the deploy role unless you intentionally maintain a custom bootstrap design. It collapses the least-privilege separation and hides the real credential-flow error.

Useful checks from the build container are:

aws sts get-caller-identity
aws sts assume-role \
  --role-arn "arn:aws:iam::$ACCOUNT:role/cdk-hnb659fds-file-publishing-role-$ACCOUNT-$AWS_REGION" \
  --role-session-name cdk-preflight >/dev/null

The first command should show the CodeBuild project role, not the CDK deploy role. If the second fails, fix the CodeBuild identity policy and/or the target role trust policy. Also confirm that the stack synthesizer qualifier is hnb659fds; a custom qualifier changes all four role names.

So you can reuse the existing bootstrap roles; no new deployment roles are required. The correction is to keep CodeBuild as the actor and let the CDK CLI perform the role assumptions.

If this fixes the asset upload, please mark it as the accepted answer so other CDK/CodeBuild users can find the credential-flow explanation.