STS configurability for Route53 dependent actions

[PhilKershaw]

• I'm submitting a ...

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior?

From a Control Tower managed estate, attempting to create a DNS Validated ACM Certificate using:

new cert.DnsValidatedCertificate(this, 'certId', {
    domainName: 'example.com',
    hostedZone: hostedZone,
    region: this.region
})

Amongst other things, a role is assumed in order to Upsert DNS records to Route53. This fails with an access error:

Caught error AccessDenied: User: arn:aws:sts::[accountId]:assumed-role/[role name] is not authorized to access this resource. Uploading FAILED message to S3.

This is due to the Hosted Zone residing within the master account whilst attempting to deploy to a separate production account.

Note, custom policies/roles manually added to IAM and an STS policy added to the SSO Permission Set have been added to no avail.

• What is the expected behavior (or behavior of feature suggested)?

Allowing the attachment of custom policies to the built-in assumed role or allowing over-riding of said role.

• What is the motivation / use case for changing the behaviour or adding this feature?

Use case: As mentioned above, we manage the AWS estate with AWS Control Tower and have separate accounts for different business functions. DNS management happens to be in the management account but we'd need to enable access from other accounts in order to manage DNS records as public facing stacks need.

• Please tell us about your environment:

  • CDK CLI Version: 1.2.0
  • Module Version: 1.2.0
  • OS: OSX Mojave
  • Language: JavaScript

[sachin10101998]

+1 . The role should be allowed to be overridden.

[TheRealAmazonKendra]

We are deprecating DnsValidatedCertificate. If you experience this issue in another context, please open a new issue.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[TheRealAmazonKendra]

For reference: #21982