cdk Bootstrap 29 denies assume role calls using external ids

[jcdelc-veho]

Hi team!

Currently, we have faced some issues while implementing the bootstrapping of our aws accounts using the version 29 of the template provided by AWS.

Specifically, the new template denies all the assume role on the CDK roles when an external id is provided Code Reference, but the github pipeline adds it automatically, and doesn't provide any mechanism to avoid setting it up Code Reference

I'm opening this issue to ask for a solution that allows the consumer of this package to avoid setting up such property, in order to consume the new bootstrap configuration without issues.

Thanks!

[AlJohri]

As a temporary work around, folks can run cdk bootstrap --deny-external-id false to disable this feature of the CDK Bootstrap stacks.

Would also be interested to understand a more official solution given "By default, CDK Bootstrap roles are not designed to be deputized".

[AndrewChemis]

I came up with this solution:

 * Patches the GitHubWorkflow's workflowFile to remove role-external-id from all steps.
 *
 * Workaround for https://github.com/cdklabs/cdk-pipelines-github/issues/1414
 * where CDK Bootstrap v29 denies role assumption when external ID is provided,
 * but cdk-pipelines-github hardcodes `role-external-id: Pipeline`.
 *
 * This works by intercepting the `update` method on the workflowFile to strip
 * role-external-id from the workflow object before it's stored.
 */
function patchWorkflowFileToRemoveExternalId(workflow: GitHubWorkflow): void {
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  const workflowFile = workflow.workflowFile as any;
  const originalUpdate = workflowFile.update.bind(workflowFile);

  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  workflowFile.update = (obj: any) => {
    // Remove role-external-id from all job steps
    if (obj?.jobs) {
      for (const job of Object.values(obj.jobs)) {
        // eslint-disable-next-line @typescript-eslint/no-explicit-any
        for (const step of (job as any).steps ?? []) {
          if (step.with?.['role-external-id']) {
            delete step.with['role-external-id'];
          }
        }
      }
    }
    originalUpdate(obj);
  };
}