(bootstrap): Use Bootstrap w/o creating AWS IAM Roles

[collin-miller]

Describe the feature

I would like to be able to use the AWS CDK but don't want to use a Stack Role to do the deployments (otherwise using iam:PassRole when creating a cloudformation stack during bootstrap). This is a privilege escalation pathway for humans and deployment roles who have update stack permissions.

Use Case

I would like to either avoid bootstrapping an account or get the account to bootstrap without IAM resources/permissions.

Proposed Solution

Make it easy to use only the permissions assumed by the principal executing cdk deploy...

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.89.0 (build 2ad6683)

Environment details (OS name and version, etc.)

macOs