Ability to provide custom role for aws-events-targets

[tmo-trustpilot]

Currently if you wish to use a SfnStateMachine target from CloudWatch events it will generate a new Role and Policy document for executing the state machine. I believe this also applies for the other target types as well.

https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-events-targets/lib/state-machine.ts#L34-L37

I would like to be able to provide or override the role used.

Use Case

Our organisational controls don't allow for arbitrary new roles and policies to be added like this. We have predetermined roles we can use for our services, and if new permissions are required they are handled centrally.

Being able to provide the execution role here allows our security team to retain control of IAM roles and policies.

Proposed Solution

Add an override or optional parameter for passing an existing role to the AWS::Events::Rule that it will use.

Other

It would probably make sense to add this override for all of the event targets for consistency.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[tmo-trustpilot]

I've attempted to work around this temporarily by copying the SfnStateMachine class locally with a modification to pass in the IRole, and I've discovered the RunLambdaTask class generates policy statements on the role.

https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-stepfunctions-tasks/lib/lambda/run-lambda-task.ts#L89

Because I'm passing in the same role that is declared on the lambda, this policy document causes a circular dependency in the CloudFormation.

[tmo-trustpilot]

The StateMachine class will also produce policy documents and attempt to attach them to the role if you enable logging:

https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-stepfunctions/lib/state-machine.ts#L202-L215

[rix0rrr]

Duplicate of #7859 and of #5865

[tmo-trustpilot]

@ayush987goyal and @shivlaks, thank you!