Merge pull request #396 from co-cddo/chore/role-chaining

fix(ci-lease): skip session tagging on lease-role assume

Author: chrisns

.github/workflows/scenario-ci.yml

@@ -103,6 +103,9 @@ jobs:
           aws-region: us-east-1
           role-duration-seconds: 21600
           role-chaining: true
+          # The default session-tag attempt requires sts:TagSession in the
+          # target role's trust policy, which CIDeployRole doesn't grant.
+          role-skip-session-tagging: true
 
       - name: Deploy scenario stack
         id: deploy