Search code examples
amazon-web-servicesaws-cloudformationaws-codepipeline

CodePipeline StackSet integration fails wtth ValidationException because of role

Recentry CodePipeline introduced CloudFormation StackSet integration ( https://aws.amazon.com/about-aws/whats-new/2020/12/aws-codepipeline-supports-deployments-with-cloudformation-stacksets/ ). I'm trying to build a pipeline that deploys stack set but pipeline action fails with message:

An API call to CloudFormation.UpdateStackSet (RequestId: {ID}) returned a ValidationError error: You must provide an administration role ARN with the correct PassRole permission to perform an update operation on this StackSet.

The stack set is already there and the roles are working fine, I'm just trying to bind the deployment into CodePipeline using new integration feature (using same roles).

My pipeline role is allowed to pass stack set administration role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::<ID>:role/infrastructure-v1-organiz-StackSetAdministratorRol-1Q81WRE9ZGNAT"
            ],
            "Effect": "Allow"
        }
    ]
}

This is the role that is used by stack set:

enter image description here

And this role is being passed by codepipeline:

enter image description here

Solution

  • Contacted AWS support - it is a limitation (broken in my opinion) of CodePipeline-CloudFormation integration. CodePipeline enforces using very particular values (where CloudFormation does not need that - we have stack set deployed in early 2019 and it's impossible to provision it with current CodePipeline integration).

    I issued a feature request to loosen this validation.