Is it possible to customize adminrole and executionrole?

[jwow94]

Is it possible to customize {AppName}-adminrole and {AppName}-executionrole, that are created when the copilot app init command is executed?

In my company, we have constraints on the naming of IAM roles, so we need to include uppercase letters in {AppName} and modify the -adminrole string. Additionally, we are not allowed to use inline policies, so we need to create managed policies and attach them to the IAM roles.

[iamhopaul123]

Hello @jwow94. Sorry at this moment I don't think these roles are customizable. We can probably get this around by introducing an override mechanism for app init as what we have for env and workload. Usually we would encourage users to restrict the permission by permission boundary and they can specify the predefined permission boundary by running copilot app init --permissions-boundary.

[jwow94]

Thank you for your prompt response. It's unfortunate to hear that the roles are not customizable at this moment. The suggestion of introducing an override mechanism for app init, similar to what is available for env and workload, sounds like a potential solution for our situation. Meanwhile, I will look into the possibility of restricting the permission by permission boundary as you suggested.

I hope that the feature for customizing IAM roles could be considered for future updates, as it would greatly help in accommodating the needs of companies like ours.

Thank you for your assistance.

[WillGibson]

I have arrived here for a different use case.

We would like to be able to assume the admin role in our test pipelines so that we can run deploy commands etc., but we cannot do that without changing the trust policy to include the role used by our CodeBuild project.

Is our best option to simple make a new role with the same policy settings as the execution role and assume that?