feat(app-staging-synthesizer): cross-account support

packages/@aws-cdk/app-staging-synthesizer-alpha/README.md

@@ -265,6 +265,23 @@ const app = new App({
 });
 ```
 
+### Cross-account support
+
+By default, the created roles to upload the assets are only assumable by the owning account.
+To be able to have e.g. your pipeline in another account, you can trust other accounts manually.
+This is similar to calling the old bootstrap with the `--trust` flag.
+
+```ts
+import * as iam from 'aws-cdk-lib/aws-iam';
+
+const app = new App({
+  defaultStackSynthesizer: AppStagingSynthesizer.defaultResources({
+    appId: 'my-app-id',
+    additionalTrustedPrincipals: [new iam.AccountPrincipal('999999999999')],
+  }),
+});
+```
+
 ## Using a Custom Staging Stack per Environment
 
 If you want to customize some behavior that is not configurable via properties,

packages/@aws-cdk/app-staging-synthesizer-alpha/lib/default-staging-stack.ts

@@ -121,6 +121,16 @@ export interface DefaultStagingStackOptions {
    * @default 'StagingStack'
    */
   readonly stagingStackNamePrefix?: string;
+
+  /**
+   * Specify trusted principals for e.g. cross-account usage.
+   * They will be added to the default principal.
+   * Both file-role and image-role will be modified.
+   * Will be ignored when custom roles are provided.
+   *
+   * @default - no additional principals will be trusted
+   */
+  readonly additionalTrustedPrincipals?: iam.IPrincipal[]
 }
 
 /**
@@ -238,6 +248,8 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
 
   private readonly deployRoleArn?: string;
 
+  private readonly additionalTrustedPrincipals: iam.IPrincipal[];
+
   constructor(scope: App, id: string, private readonly props: DefaultStagingStackProps) {
     super(scope, id, {
       ...props,
@@ -263,6 +275,8 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
     this.providedFileRole = props.fileAssetPublishingRole?._specialize(specializer);
     this.providedImageRole = props.imageAssetPublishingRole?._specialize(specializer);
     this.stagingRepos = {};
+
+    this.additionalTrustedPrincipals = props.additionalTrustedPrincipals ?? [];
   }
 
   private validateAppId(id: string) {
@@ -298,7 +312,10 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
     const roleName = this.fileRoleName;
     this.fileRole = new iam.Role(this, 'CdkFileRole', {
       roleName,
-      assumedBy: new iam.AccountPrincipal(this.account),
+      assumedBy: new iam.CompositePrincipal(
+        new iam.AccountPrincipal(this.account),
+        ...this.additionalTrustedPrincipals,
+      ),
     });
 
     this.fileRoleManifestArn = Stack.of(this).formatArn({
@@ -329,7 +346,10 @@ export class DefaultStagingStack extends Stack implements IStagingResources {
     const roleName = this.imageRoleName;
     this.imageRole = new iam.Role(this, 'CdkImageRole', {
       roleName,
-      assumedBy: new iam.AccountPrincipal(this.account),
+      assumedBy: new iam.CompositePrincipal(
+        new iam.AccountPrincipal(this.account),
+        ...this.additionalTrustedPrincipals,
+      ),
     });
     this.imageRoleManifestArn = Stack.of(this).formatArn({
       partition: '${AWS::Partition}',

packages/@aws-cdk/app-staging-synthesizer-alpha/test/app-staging-synthesizer.test.ts

@@ -2,6 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { App, Stack, CfnResource, FileAssetPackaging, Token, Lazy, Duration } from 'aws-cdk-lib';
 import { Match, Template } from 'aws-cdk-lib/assertions';
+import { AccountPrincipal } from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as cxschema from 'aws-cdk-lib/cloud-assembly-schema';
 import { CloudAssembly } from 'aws-cdk-lib/cx-api';
@@ -547,6 +548,60 @@ describe(AppStagingSynthesizer, () => {
     expect(() => app.synth()).toThrowError(/Staging resource template cannot be greater than 51200 bytes/);
   });
 
+  test('pass trusted principals', () => {
+    // GIVEN
+    app = new App({
+      defaultStackSynthesizer: AppStagingSynthesizer.defaultResources({
+        appId: APP_ID,
+        additionalTrustedPrincipals: [new AccountPrincipal('999999999999')],
+      }),
+    });
+    stack = new Stack(app, 'Stack', {
+      env: {
+        account: '000000000000',
+        region: 'us-east-1',
+      },
+    });
+
+    stack.synthesizer.addDockerImageAsset({
+      directoryName: '.',
+      sourceHash: 'abcdef',
+      assetName: 'abcdef',
+    });
+
+    // WHEN
+    const asm = app.synth();
+
+    // THEN
+    const crossAccountAssumeRolePolicyDocument = {
+      Statement: Match.arrayEquals([
+        Match.anyValue(),
+        {
+          Effect: 'Allow',
+          Principal: {
+            AWS: {
+              'Fn::Join': [
+                '',
+                Match.arrayWith([
+                  ':iam::999999999999:root',
+                ]),
+              ],
+            },
+          },
+          Action: 'sts:AssumeRole',
+        },
+      ]),
+    };
+    Template.fromJSON(getStagingResourceStack(asm).template).hasResourceProperties('AWS::IAM::Role', {
+      AssumeRolePolicyDocument: crossAccountAssumeRolePolicyDocument,
+      RoleName: 'cdk-appid-file-role-us-east-1',
+    });
+    Template.fromJSON(getStagingResourceStack(asm).template).hasResourceProperties('AWS::IAM::Role', {
+      AssumeRolePolicyDocument: crossAccountAssumeRolePolicyDocument,
+      RoleName: 'cdk-appid-image-role-us-east-1',
+    });
+  });
+
   /**
   * Evaluate a possibly string-containing value the same way CFN would do
   *