fix(cli): unable to set termination protection for pipeline stacks

[ghost]

Add cloudformation:UpdateTerminationProtection permission to the pipeline deployment role so that termination protection can be enabled for pipeline stacks.

Currently, creating a pipeline stack with termination protection set to true causes an error:

 ❌  PipelineStack failed: AccessDenied: User: arn:aws:sts::123456789012:assumed-role/cdk-hnb659fds-deploy-role-123456789012-eu-west-1/aws-cdk-william is not authorized to perform: cloudformation:UpdateTerminationProtection on resource: arn:aws:cloudformation:eu-west-1:123456789012:stack/PipelineStack/dbf8ad70-e5f4-11ea-961d-021e20b443de

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[ghost]

As far as I can determine, there are no tests for the bootstrap stack template. Presumably this would mean that in this case the failed PR Linter check should be ignored?

[ghost]

@rix0rrr: Sorry to trouble you directly (and I chose you simply because you're a recent committer!), but I suspect this PR may be languishing because of the failed PR Linter check which, as I mentioned above, seems to be inappropriate here because as far as I can tell there are no tests for the bootstrap template. Would you be able to have a look and advise if there's anything more I need to do? Thanks.

[shivlaks]

changes look fine. have you run the integ tests yarn integ-cli or npm run integ-cli
there are some bootstrap integration tests that will can be executed. The tests can be found here

[ghost]

Thanks for your reply, @shivlaks. I had been looking (fruitlessly, of course) for tests that check the actual deployed bootstrap resources. The CLI integration tests do pass.

Test Suites: 2 passed, 2 total
Tests:       40 passed, 40 total
Snapshots:   0 total
Time:        2713.236s, estimated 2816s
Ran all test suites.
✨  Done in 8328.37s.

Pull request has been modified.

[ghost]

Updated to current master branch. Which means re-approval is required, apologies.

[ghost]

Hello @shivlaks. Is there anything more I can (or need to) do to get this PR merged?

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[shivlaks]

@williterate approved! sorry for the delay. I wanted to sync with @rix0rrr to make sure he was good with it.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 35ec83b
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).