CodePipeline: Maximum policy size of 10240 bytes exceeded for role xxx

[poppoerika]

What is the problem?

We have a CDK pipeline that creates several other CodePipelines during its execution. Most of the pipelines it creates deploy one or two CloudFormation stacks to various accounts. However, we recently attempted to add a new pipeline that deploys 5 CloudFormation stacks. Afterward we encountered the following error with the Logical ID xxxRoleDefaultPolicyxxx:

Maximum policy size of 10240 bytes exceeded for role xxx (Service: AmazonIdentityManagement; Status Code: 409; Error Code: LimitExceeded; Request ID: xxx; Proxy: null)

It seems that more AssumeRole statements are added to the role as we add stacks to the pipeline until the stack update is cancelled due to exceeding the maximum policy size.

The following are a few examples of the PolicyDocument statements added automatically:

 {
                     "Action":"sts:AssumeRole",
                     "Effect":"Allow",
                     "Resource":{
                        "Fn::GetAtt":[
                           "xxxCodePipelineActionRolexxx",
                           "Arn"
                        ]
                     }
                  },
                  {
                     "Action":"sts:AssumeRole",
                     "Effect":"Allow",
                     "Resource":{
                        "Fn::GetAtt":[
                           "xxxPlaceholderActionNameCodePipelineActionRolexxx",
                           "Arn"
                        ]
                     }
                  },
                  {
                     "Action":"sts:AssumeRole",
                     "Effect":"Allow",
                     "Resource":{
                        "Fn::GetAtt":[
                           "xxxCodePipelineActionRolexxx",
                           "Arn"
                        ]
                     }
                  },

It seems that there are some policies created by CDK pipeline that grow in proportion to the number of resources in the child pipeline, so that after a certain point there is no way to deploy the CDK pipeline.

This has caused us not to be able to deploy all the stacks from a single stage in this wave, which resulted in extra engineer effort for the deployment.

Is there any way to prevent the policy from growing unbounded like this?

Please let us know if you need additional snippets from the generated template or anything else.

Reproduction Steps

--

What did you expect to happen?

The new CodePipeline that deploys 5 CloudFormation stacks in our CDK pipeline gets executed without any issues.

What actually happened?

Some policies created by CDK pipeline that grow in proportion to the number of resources in the child pipeline, so that after a certain point there is no way to deploy the CDK pipeline.

CDK CLI Version

2.4.0

Framework Version

No response

Node.js Version

--

OS

--

Language

Typescript

Language Version

4.4.2

Other information

No response

[NGL321]

Hey @poppoerika,

Thank you for reporting this! This is a design problem we are well aware of and have a fix in progress. I am resolving this issue in favor of tracking via #16244 and the potentially resolving PR #19114

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.