Add permissions to assume cdk roles

West-Michigan-AWS-Users-Group · Jan 9, 2025 · dc1a0b9 · dc1a0b9
1 parent e309b04
commit dc1a0b9
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/lib/wmaug-management-infrastructure-sso.ts b/lib/wmaug-management-infrastructure-sso.ts
@@ -106,7 +106,18 @@ export class Sso extends cdk.Stack {
     const wmaugMemberPermissionSet = new sso.CfnPermissionSet(
       this,
       "wmaugMemberPermissionSet",
+      // allow members to assume deploy roles for manual deployment
       {
+        inlinePolicy: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Action: "sts:AssumeRole",
+              Resource: "arn:aws:iam::*:role/cdk-*",
+            },
+          ],
+        },
         instanceArn: instanceArnParam.valueAsString,
         name: "wmaugMemberPermissionSet",
         description: "Permission set WMAUG members will use",