fix(codepipeline): CloudFormation deployment role always gets pipeline bucket and key permissions

[skinny85]

Previously, we only explicitly granted the CloudFormation CodePipeline action deployment role access to the pipeline bucket
(and, by extension, its KMS key)
when the action was deploying into a different account.
However, that meant in the single account case,
if the pipeline had a key defined,
the role would never be added to the key's policy,
and any deployment requiring access to the artifacts bucket
(like a Lambda function) would fail.
This fixes the bug by always granting the deployment role permissions to the pipeline bucket (and thus the key as well).

Fixes #5183

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[mergify]

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

• PR title type(scope): text
  • type: fix, feat, refactor go into CHANGELOG, chore is hidden
  • scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
  • text: use all lower-case, do not end with a period, do not include issue refs
• PR Description
  • Rationale: describe rationale of change and approach taken
  • Issues: indicate issues fixed via: fixes #xxx or closes #xxx
  • Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
• Testing
  • Unit test added. Prefer to add a new test rather than modify existing tests
  • CLI or init templates change? Re-run/add CLI integration tests
• Documentation
  • README: update module README to describe new features
  • API docs: public APIs must be documented. Copy from official AWS docs when possible
  • Design: for significant features, follow design process

[aws-cdk-automation]

AWS CodeBuild CI Report

• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request is now being automatically merged.

[lukehedger]

Hey @skinny85 - I just ran into this bug and found the issue/PR here. When do you think this fix will land in a release? I am wondering whether to put in a workaround or wait for the next version to include this. Thanks

[skinny85]

@lukehedger it will be part of CDK version 1.19.0, which will be released 2 weeks from now (we're not having a release next week because of re:Invent). Hope this helps you make a decision!

[lukehedger]

Thanks @skinny85, that's good to know. I've used the workaround described here #5183 (comment) for now and will watch out for the release.