如何使用 Jenkins 的 AWS 角色部署 CDK？

Question

Hi I have created CDK project with jenkins. I want to deploy with role. For example cdk deploy with role. For example In cloudformation I was doing like below.

cfn_manage deploy-stack \
  --stack-name "$CFN_CDK_STACK" \
  --template-file "cloudformation/templates/cdk.yml" \
  --parameters-file "$PARAMS_FILE" \
  --role-name infra-cfnrole-location-nonprivileged

Now I have CDK project as below.

checkout scm
              withCredentials([[$class: 'AmazonWebServicesCredentialsBinding',credentialsId: "${env.PROJECT_ID}-aws-${CFN_ENVIRONMENT}"]]) {
                abc = docker.build('cdkimage', "--build-arg http_proxy=${env.http_proxy} --build-arg https_proxy=${env.https_proxy} .")
                abc.inside{
                sh 'ls -la'
                sh "bash ./scripts/build.sh"
              }

Then inside build.sh

NONPRIV_ROLE_NAME='infra-cfnrole-location-nonprivileged'
aws sts assume-role --role-arn 'arn:aws:iam::id:role/infra-cfnrole-location-nonprivileged' --role-session-name jenkins --query '[Credentials.AccessKeyId,Credentials.SecretAccessKey,Credentials.SessionToken]' --output text
cdk synth
cdk deploy

This is throwing error

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::id:user/infra-prjauth-location is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::187628286232:role/infra-cfnrole-location-nonprivileged

For the role cfnrole-location-nonprivileged in trusted relationships I have below policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudformation.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Can someone help me to deploy with role? Any help would be appreciated. Thanks

Answer 1

I think the issue is that you haven't specifically trusted your IAM User in the IAM Role's trusted relationships.

Assuming that this role has the correct permissions needed for a CDK deploy (see here for more info on that), you need to allow your IAM user to access the role, not cloudformation . Cloudformation already has access to your account resources.

I think this version of the trusted relationships policy should do the trick:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": "<full ARN of the relevant user>",
      "Action": "sts:AssumeRole"
    }
  ]
}

Let me know if it works!