(pipelines): role on CodeBuildStep doesn't get used on CodeBuildAction

[tobytipton]

What is the problem?

When passing a role to the CodeBuildStep the role is used on the project, but not the CodeBuildAction.

This results in a role for each CodeBuildAction being created which can cause Maximum policy size of 10240 bytes exceeded for on the Pipeline Default Role if you have a lot of CodeBuildSteps.

https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/pipelines/lib/codepipeline/_codebuild-factory.ts#L305-L322

is missing role: this.props.role to leverage that role.

Reproduction Steps

This is a quick reproduction step typically the CodeBuildStep would be used as a pre or post on a stage or wave.

  const buildRole = new iam.Role(
    pipelineStack,
    'BuildRole',
    {
      roleName: 'BuildRole',
      assumedBy: new iam.ServicePrincipal('codebuild.amazon.com'),
    },
  );
  new cdkp.CodePipeline(pipelineStack, 'Pipeline', {
    synth: new cdkp.CodeBuildStep('Synth', {
      commands: ['/bin/true'],
      input: cdkp.CodePipelineSource.gitHub('test/test', 'main'),
      role: buildRole,
    }),
  });

What did you expect to happen?

Expect to have the role used for Project and the build action.

  Template.fromStack(pipelineStack).hasResourceProperties('AWS::CodeBuild::Project', {
    ServiceRole: {
      'Fn::GetAtt': [
        'BuildRole41B77417',
        'Arn',
      ],
    },
  });

  expect(pipelineStack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
    Stages: [
      // source stage
      {},
      // build stage,
      {
        Actions: [
          {
            ActionTypeId: {
              Category: 'Build',
              Owner: 'AWS',
              Provider: 'CodeBuild',
            },
            RoleArn: {
              'Fn::GetAtt': [
                'BuildRole41B77417',
                'Arn',
              ],
            },
          },
        ],
      },
    ],
  });

What actually happened?

The role is used for the project but not the Code Build Action. The Code Build Action gets a different role which is created for each build action.

for example

                 "RoleArn": {
                      "Fn::GetAtt": [
                        "PipelineBuildSynthCodePipelineActionRole4E7A6C97",
                        "Arn"
                      ]
                    },

CDK CLI Version

N/A

Framework Version

No response

Node.js Version

N/A

OS

N/A

Language

Typescript

Language Version

No response

Other information

This issue can be seen directly in testing the code build step.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.