Disable fallback to user's role when a cdk-* role cannot be assumed

[lobodpav]

Describe the feature

When running deploy or destroy commands, it would be amazing if the CDK would fail when a cdk-* role cannot be assumed (e.g. cdk-lookup or cdk-deploy).

Use Case

It's very easy to use/paste an incorrect Account ID in the CDK_DEPLOY_ACCOUNT when running CDK locally. When that happens, users can accidentally deploy local changes to the production environments.

I know that it would have to be a coincidence of selecting the wrong account ID along with the wrong profile. However, if CDK would not fall back to the user's profile by default, it would be possible to define a Trust policy at the cdk-* role level allowing only pipelines (e.g. OIDC roles) to perform production deployments.

Proposed Solution

1. Prevent a fallback to the user's role when the cdk-* role cannot be assumed.
2. Introduce a --force parameter that would fall back to the user's role even if the CDK roles can't be assumed.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.140.0

Environment details (OS name and version, etc.)

macOS 14.5

[pahud]

Thank you for your feedback. We definitely need to hear more thoughts from the community. Please help us prioritize with 👍.

[moltar]

I think I'm running into a similar issue in a different context.

I'm using CodeBuild for GitHub Actions runners. And CodeBuild of course has native identity via EC2 metadata lookup.

So synth step always tried to use it for lookup and of course the CodeBuild doesn't have the right policies because it's only meant to be used for GH Actions which just performs the basic build steps.