How to deploy CDK with AWS role from Jenkins? - amazon-web-services

Question

Hi I have created CDK project with jenkins. I want to deploy with role. For example cdk deploy with role. For example In cloudformation I was doing like below.
cfn_manage deploy-stack \
--stack-name "$CFN_CDK_STACK" \
--template-file "cloudformation/templates/cdk.yml" \
--parameters-file "$PARAMS_FILE" \
--role-name infra-cfnrole-location-nonprivileged
Now I have CDK project as below.
checkout scm
withCredentials([[$class: 'AmazonWebServicesCredentialsBinding',credentialsId: "${env.PROJECT_ID}-aws-${CFN_ENVIRONMENT}"]]) {
abc = docker.build('cdkimage', "--build-arg http_proxy=${env.http_proxy} --build-arg https_proxy=${env.https_proxy} .")
abc.inside{
sh 'ls -la'
sh "bash ./scripts/build.sh"
}
Then inside build.sh
NONPRIV_ROLE_NAME='infra-cfnrole-location-nonprivileged'
aws sts assume-role --role-arn 'arn:aws:iam::id:role/infra-cfnrole-location-nonprivileged' --role-session-name jenkins --query '[Credentials.AccessKeyId,Credentials.SecretAccessKey,Credentials.SessionToken]' --output text
cdk synth
cdk deploy
This is throwing error
An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::id:user/infra-prjauth-location is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::187628286232:role/infra-cfnrole-location-nonprivileged
For the role cfnrole-location-nonprivileged in trusted relationships I have below policy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "cloudformation.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Can someone help me to deploy with role? Any help would be appreciated. Thanks

Answer 1

I think the issue is that you haven't specifically trusted your IAM User in the IAM Role's trusted relationships.
Assuming that this role has the correct permissions needed for a CDK deploy (see here for more info on that), you need to allow your IAM user to access the role, not cloudformation. Cloudformation already has access to your account resources.
I think this version of the trusted relationships policy should do the trick:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": "<full ARN of the relevant user>",
"Action": "sts:AssumeRole"
}
]
}
Let me know if it works!