feat(pipelines): actions can default to the pipeline service role instead of a newly created role #33991

hwum · 2025-04-01T01:27:02Z

Issue # 27065

Reason for this change

Lots of customer reported they don't want such many new roles generated in cdk level.
Current cdk library will help customer to generate a action role if no role configured.
But in Codepipeline backend logic, the pipeline service role will be used as default action role, which the cdk library doesn't align.

Description of changes

Support this field in L3 construct. L2 construct support has been delivered: d8bbc1c

Describe any new or updated permissions being added

No

Description of how you validated changes

Local deployment/unit test/integ test

Checklist

[Y] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

codecov · 2025-04-01T01:35:46Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.98%. Comparing base (1418277) to head (4695ec1).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33991   +/-   ##
=======================================
  Coverage   83.98%   83.98%           
=======================================
  Files         120      120           
  Lines        6976     6976           
  Branches     1178     1178           
=======================================
  Hits         5859     5859           
  Misses       1005     1005           
  Partials      112      112

Flag	Coverage Δ
suite.unit	`83.98% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`83.98% <ø> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

kaizencc

minor comments, otherwise looks good

kaizencc · 2025-04-01T20:39:14Z

packages/aws-cdk-lib/pipelines/lib/codepipeline/private/codebuild-factory.ts

@@ -1,3 +1,4 @@
+/* eslint-disable no-console */


these consoles are all debugs right? at any rate we can't console.log like this :)

lol forgot to delete after debuging

kaizencc · 2025-04-01T20:40:55Z

packages/aws-cdk-lib/pipelines/lib/codepipeline/codepipeline.ts

+  /**
+   * Allow no-actionRole-configured actions use pipeline service role
+   */
+  public readonly usePipelineRoleForActions: boolean;


Suggested change

/**

* Allow no-actionRole-configured actions use pipeline service role

*/

public readonly usePipelineRoleForActions: boolean;

/**

* Allow no-actionRole-configured actions to use the pipeline service role

* instead of creating a new role for each action

*/

public readonly usePipelineRoleForActions: boolean;

is no-actionRole-configured a thing you are referencing? otherwise not sure why its hyphenated.

I'll revise it

kaizencc · 2025-04-01T20:41:30Z

...ws-cdk-testing/framework-integ/test/pipelines/test/integ.pipeline-use-default-action-role.ts

+        // input: pipelines.CodePipelineSource.gitHub('cdklabs/construct-hub-probe', 'main', {
+        //   trigger: GitHubTrigger.POLL,
+        // }),


kaizencc · 2025-04-01T20:43:39Z

packages/aws-cdk-lib/pipelines/README.md

@@ -976,6 +976,10 @@ Note that if you provide an existing pipeline, you cannot provide values for
 `pipelineName`, `crossAccountKeys`, `reuseCrossRegionSupportStacks`, or `role`
 because those values are passed in directly to the underlying `codepipeline.Pipeline`.

+### Use pipeline service role as default action role in pipeline
+
+If you don't want cdk helps you automatically create roles for each actions(like CodeBuild step ,etc.),you could set `usePipelineServiceRoleForActions` as true to use pipeline service role as default action role in Codepipeline if no action role provided.


Suggested change

If you don't want cdk helps you automatically create roles for each actions(like CodeBuild step ,etc.),you could set `usePipelineServiceRoleForActions` as true to use pipeline service role as default action role in Codepipeline if no action role provided.

By default CDK automatically creates roles for each action (`CodeBuildStep`, etc).

If you prefer to use the pipeline service role as default instead, set the `usePipelineRoleForActions` property.

This will tell CDK to default to the pipeline service role in AWS CodePipeline if no action role is provided.

Pull request has been modified.

packages/aws-cdk-lib/pipelines/lib/codepipeline/codepipeline.ts

mergify · 2025-04-02T16:10:12Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-04-02T16:40:23Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 4695ec1
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-04-02T16:40:46Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-04-02T16:41:02Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

github-actions bot added the p2 label Apr 1, 2025

aws-cdk-automation requested a review from a team April 1, 2025 01:27

github-actions bot added the repeat-contributor [Pilot] contributed between 3-5 PRs to the CDK label Apr 1, 2025

aws-cdk-automation previously requested changes Apr 1, 2025

View reviewed changes

hwum changed the title ~~feat(pipelines) add usePipelineRoleForActions field in L3 construct~~ feat(pipelines):add usePipelineRoleForActions field in L3 construct Apr 1, 2025

hwum force-pushed the l2 branch from c282e8e to 7a72bc6 Compare April 1, 2025 01:38

hwum requested a review from aws-cdk-automation April 1, 2025 01:38

hwum changed the title ~~feat(pipelines):add usePipelineRoleForActions field in L3 construct~~ feat(codepipeline): add usePipelineRoleForActions field support in L3 construct Apr 1, 2025

hwum changed the title ~~feat(codepipeline): add usePipelineRoleForActions field support in L3 construct~~ feat(pipelines): add usePipelineRoleForActions field support in L3 construct Apr 1, 2025

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 1, 2025

kaizencc previously requested changes Apr 1, 2025

View reviewed changes

kaizencc changed the title ~~feat(pipelines): add usePipelineRoleForActions field support in L3 construct~~ feat(pipelines): actions can default to the pipeline service role instead of a newly created role Apr 1, 2025

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 1, 2025

hwum force-pushed the l2 branch from 7a72bc6 to f9bf3ed Compare April 1, 2025 21:18

feat(pipelines) add usePipelineRoleForActions field in L3 construct

e023079

hwum force-pushed the l2 branch from f9bf3ed to e023079 Compare April 1, 2025 21:27

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 1, 2025

kaizencc reviewed Apr 2, 2025

View reviewed changes

packages/aws-cdk-lib/pipelines/lib/codepipeline/codepipeline.ts Show resolved Hide resolved

Update packages/aws-cdk-lib/pipelines/lib/codepipeline/codepipeline.ts

f920b1c

kaizencc approved these changes Apr 2, 2025

View reviewed changes

Merge branch 'main' into l2

4695ec1

mergify bot merged commit 2ebc51e into aws:main Apr 2, 2025
20 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Apr 2, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(pipelines): actions can default to the pipeline service role instead of a newly created role #33991

feat(pipelines): actions can default to the pipeline service role instead of a newly created role #33991

hwum commented Apr 1, 2025

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Apr 1, 2025 •

edited

Loading

kaizencc left a comment

kaizencc Apr 1, 2025

hwum Apr 1, 2025

kaizencc Apr 1, 2025

hwum Apr 1, 2025

kaizencc Apr 1, 2025

kaizencc Apr 1, 2025

mergify bot commented Apr 2, 2025

aws-cdk-automation commented Apr 2, 2025

mergify bot commented Apr 2, 2025

github-actions bot commented Apr 2, 2025

-If you don't want cdk helps you automatically create roles for each actions(like CodeBuild step ,etc.),you could set `usePipelineServiceRoleForActions` as true to use pipeline service role as default action role in Codepipeline if no action role provided.
+By default CDK automatically creates roles for each action (`CodeBuildStep`, etc).
+If you prefer to use the pipeline service role as default instead, set the `usePipelineRoleForActions` property.
+This will tell CDK to default to the pipeline service role in AWS CodePipeline if no action role is provided.

feat(pipelines): actions can default to the pipeline service role instead of a newly created role #33991

feat(pipelines): actions can default to the pipeline service role instead of a newly created role #33991

Conversation

hwum commented Apr 1, 2025

Issue # 27065

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

codecov bot commented Apr 1, 2025 • edited Loading

Codecov Report

kaizencc left a comment

Choose a reason for hiding this comment

kaizencc Apr 1, 2025

Choose a reason for hiding this comment

hwum Apr 1, 2025

Choose a reason for hiding this comment

kaizencc Apr 1, 2025

Choose a reason for hiding this comment

hwum Apr 1, 2025

Choose a reason for hiding this comment

kaizencc Apr 1, 2025

Choose a reason for hiding this comment

kaizencc Apr 1, 2025

Choose a reason for hiding this comment

mergify bot commented Apr 2, 2025

aws-cdk-automation commented Apr 2, 2025

AWS CodeBuild CI Report

mergify bot commented Apr 2, 2025

github-actions bot commented Apr 2, 2025

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Apr 1, 2025 •

edited

Loading