feat(codepipeline-actions): add serviceRoleOverride to CodeBuildAction - #38630
Open
sanyamk23 wants to merge 1 commit into
Open
feat(codepipeline-actions): add serviceRoleOverride to CodeBuildAction#38630sanyamk23 wants to merge 1 commit into
sanyamk23 wants to merge 1 commit into
Conversation
Add an optional serviceRoleOverride prop to CodeBuildActionProps that maps to CodePipeline's ServiceRoleArnOverride action configuration, allowing the service role used when the action runs to be overridden per-action. The pipeline role is granted iam:PassRole on the provided role. Closes aws#38611 (partial: explicit override; auto-created scoped role behind a feature flag left for a follow-up)
github-actions
Bot
added
feature-request
github-actions
Bot
added
the
beginning-contributor
aws-cdk-automation
requested changes
Aug 21, 2026
aws-cdk-automation
left a comment
aws-cdk-automation
left a comment
Collaborator
There was a problem hiding this comment.
The pull request linter fails with the following errors:
❌ Features must contain a change to a README file.
❌ Features must contain a change to an integration test file and the resulting snapshot.
If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.
aws-cdk-automation
added
the
pr/needs-further-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Closes #38611 (partial — the explicit override half; the auto-created scoped role behind a feature flag is left for a follow-up)
Reason for this change
CodePipeline added a
ServiceRoleArnOverridefield to the CodeBuild action configuration, but the CDK L2CodeBuildActionhas no way to set it. This PR exposes it as an optional prop.Description of changes
serviceRoleOverride?: iam.IRoletoCodeBuildActionProps.bound()emitsServiceRoleArnOverridein the action configuration and grants the pipeline roleiam:PassRoleon the provided role.Service role selection after this change:
serviceRoleOverride→ that roleDescribe any new or updated permissions
The pipeline's role receives
iam:PassRolescoped to the ARN of the role passed inserviceRoleOverride, only when the prop is provided.Any new (or removed) dependencies
None.
Tests added
sets the ServiceRoleArnOverride configuration and grants PassRole: asserts the action configuration rendersServiceRoleArnOverrideand the pipeline policy contains the scopediam:PassRolestatement.does not set ServiceRoleArnOverride by default: asserts the key is absent when the prop is not provided.All 9 tests in
test/codebuild/codebuild-action.test.tspass; package builds clean with jsii + eslint.Checklist