aws · mergify · May 22, 2026 · Apr 18, 2026 · Apr 20, 2026 · Apr 23, 2026
diff --git a/...be3111898c6bbc0eb4f2130c9c53233b/index.js → ...a22401e05038c047ae9f071082c68586/index.js b/...be3111898c6bbc0eb4f2130c9c53233b/index.js → ...a22401e05038c047ae9f071082c68586/index.js
diff --git a/...t/integ.dns-validated-certificate.js.snapshot/integ-dns-validated-certificate.assets.json b/...t/integ.dns-validated-certificate.js.snapshot/integ-dns-validated-certificate.assets.json
diff --git a/...integ.dns-validated-certificate.js.snapshot/integ-dns-validated-certificate.template.json b/...integ.dns-validated-certificate.js.snapshot/integ-dns-validated-certificate.template.json
@@ -96,7 +96,7 @@
     "S3Bucket": {
      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
     },
-     "S3Key": "8dd3f997ac74aa13ef09bc8bed060ecdbe3111898c6bbc0eb4f2130c9c53233b.zip"
+     "S3Key": "ffb21b7e396cc684c46812aea1d2ff7ea22401e05038c047ae9f071082c68586.zip"
    },
    "Handler": "index.certificateRequestHandler",
    "Role": {

diff --git a/...eg/test/aws-certificatemanager/test/integ.dns-validated-certificate.js.snapshot/tree.json b/...eg/test/aws-certificatemanager/test/integ.dns-validated-certificate.js.snapshot/tree.json
diff --git a/...integ.cross-account-pipeline-cfn-action.js.snapshot/CdkPipelineCfnActionStack.assets.json b/...integ.cross-account-pipeline-cfn-action.js.snapshot/CdkPipelineCfnActionStack.assets.json
diff --git a/...teg.cross-account-pipeline-cfn-action.js.snapshot/CdkPipelineCfnActionStack.template.json b/...teg.cross-account-pipeline-cfn-action.js.snapshot/CdkPipelineCfnActionStack.template.json
@@ -368,7 +368,7 @@
   "Properties": {
    "Code": {
     "S3Bucket": "cdk-hnb659fds-assets-12345678-test-region",
-     "S3Key": "3423a042b818e31c1e34a19d6689ab2e5f9b70fcbe9e71df66f241b20a200bd9.zip"
+     "S3Key": "97e9ebf0b174a5c8f7faa505739022b7f509edddffcab9211dcd08b759944c4f.zip"
    },
    "Environment": {
     "Variables": {

diff --git a/...5f9b70fcbe9e71df66f241b20a200bd9/index.py → ...f509edddffcab9211dcd08b759944c4f/index.py b/...5f9b70fcbe9e71df66f241b20a200bd9/index.py → ...f509edddffcab9211dcd08b759944c4f/index.py
diff --git a/...s-codepipeline-actions/test/integ.cross-account-pipeline-cfn-action.js.snapshot/tree.json b/...s-codepipeline-actions/test/integ.cross-account-pipeline-cfn-action.js.snapshot/tree.json
diff --git a/...s-account-pipeline-sfn-action.js.snapshot/CdkPipelineStepFunctionsActionStack.assets.json b/...s-account-pipeline-sfn-action.js.snapshot/CdkPipelineStepFunctionsActionStack.assets.json
diff --git a/...account-pipeline-sfn-action.js.snapshot/CdkPipelineStepFunctionsActionStack.template.json b/...account-pipeline-sfn-action.js.snapshot/CdkPipelineStepFunctionsActionStack.template.json
@@ -369,7 +369,7 @@
   "Properties": {
    "Code": {
     "S3Bucket": "cdk-hnb659fds-assets-12345678-test-region",
-     "S3Key": "3423a042b818e31c1e34a19d6689ab2e5f9b70fcbe9e71df66f241b20a200bd9.zip"
+     "S3Key": "97e9ebf0b174a5c8f7faa505739022b7f509edddffcab9211dcd08b759944c4f.zip"
    },
    "Environment": {
     "Variables": {

diff --git a/...5f9b70fcbe9e71df66f241b20a200bd9/index.py → ...f509edddffcab9211dcd08b759944c4f/index.py b/...5f9b70fcbe9e71df66f241b20a200bd9/index.py → ...f509edddffcab9211dcd08b759944c4f/index.py
diff --git a/...s-codepipeline-actions/test/integ.cross-account-pipeline-sfn-action.js.snapshot/tree.json b/...s-codepipeline-actions/test/integ.cross-account-pipeline-sfn-action.js.snapshot/tree.json
diff --git a/...5f9b70fcbe9e71df66f241b20a200bd9/index.py → ...f509edddffcab9211dcd08b759944c4f/index.py b/...5f9b70fcbe9e71df66f241b20a200bd9/index.py → ...f509edddffcab9211dcd08b759944c4f/index.py
diff --git a/...ctions/test/integ.pipeline-commands.js.snapshot/aws-cdk-codepipeline-commands.assets.json b/...ctions/test/integ.pipeline-commands.js.snapshot/aws-cdk-codepipeline-commands.assets.json
diff --git a/...ions/test/integ.pipeline-commands.js.snapshot/aws-cdk-codepipeline-commands.template.json b/...ions/test/integ.pipeline-commands.js.snapshot/aws-cdk-codepipeline-commands.template.json
@@ -1,4 +1,4 @@
 {
 "Resources": {
  "SourceBucketKey79929454": {
   "Type": "AWS::KMS::Key",
@@ -388,7 +388,7 @@
     "S3Bucket": {
      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
     },
-     "S3Key": "3423a042b818e31c1e34a19d6689ab2e5f9b70fcbe9e71df66f241b20a200bd9.zip"
+     "S3Key": "97e9ebf0b174a5c8f7faa505739022b7f509edddffcab9211dcd08b759944c4f.zip"
    },
    "Environment": {
     "Variables": {

diff --git a/...rk-integ/test/aws-codepipeline-actions/test/integ.pipeline-commands.js.snapshot/tree.json b/...rk-integ/test/aws-codepipeline-actions/test/integ.pipeline-commands.js.snapshot/tree.json
diff --git a/...5f9b70fcbe9e71df66f241b20a200bd9/index.py → ...f509edddffcab9211dcd08b759944c4f/index.py b/...5f9b70fcbe9e71df66f241b20a200bd9/index.py → ...f509edddffcab9211dcd08b759944c4f/index.py
-Original file line number
+Diff line change
@@ -1,4 +1,4 @@
     {
     Check failure
        on line 1
        in packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-commands.js.snapshot/aws-cdk-codepipeline-commands.template.json
  



  
      
View workflow job for this annotation

  

  
    
    GitHub Actions / Security Guardian Results with resolved templates
  

  
    
      iam-role-root-principal-needs-conditions.guard
    
  

  
    [Type: Resolved] Root principal requires a strict condition (ArnEquals or StringEquals) to scope down who can assume this role. ArnLike/StringLike are not accepted as they allow wildcards.
  

    
        
    Raw output
  


      
        
          Check was not compliant as property [Condition] is missing. Value traversed to [Path=/Resources/PipelineSourceCodePipelineActionRoleC6F9E7F5/Properties/AssumeRolePolicyDocument/Statement/0[L:586,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
Check was not compliant as property [Condition.ArnEquals] is missing. Value traversed to [Path=/Resources/PipelineSourceCodePipelineActionRoleC6F9E7F5/Properties/AssumeRolePolicyDocument/Statement/0[L:586,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
Check was not compliant as property [Condition.StringEquals] is missing. Value traversed to [Path=/Resources/PipelineSourceCodePipelineActionRoleC6F9E7F5/Properties/AssumeRolePolicyDocument/Statement/0[L:586,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
Check was not compliant as property [Condition] is missing. Value traversed to [Path=/Resources/PipelineComputeCommandsCodePipelineActionRole992CFF18/Properties/AssumeRolePolicyDocument/Statement/0[L:663,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
Check was not compliant as property [Condition.ArnEquals] is missing. Value traversed to [Path=/Resources/PipelineComputeCommandsCodePipelineActionRole992CFF18/Properties/AssumeRolePolicyDocument/Statement/0[L:663,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
Check was not compliant as property [Condition.StringEquals] is missing. Value traversed to [Path=/Resources/PipelineComputeCommandsCodePipelineActionRole992CFF18/Properties/AssumeRolePolicyDocument/Statement/0[L:663,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
Check was not compliant as property [Condition] is missing. Value traversed to [Path=/Resources/PipelineDeployDeployActionCodePipelineActionRole1C288A60/Properties/AssumeRolePolicyDocument/Statement/0[L:741,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
Check was not compliant as property [Condition.ArnEquals] is missing. Value traversed to [Path=/Resources/PipelineDeployDeployActionCodePipelineActionRole1C288A60/Properties/AssumeRolePolicyDocument/Statement/0[L:741,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
Check was not compliant as property [Condition.StringEquals] is missing. Value traversed to [Path=/Resources/PipelineDeployDeployActionCodePipelineActionRole1C288A60/Properties/AssumeRolePolicyDocument/Statement/0[L:741,C:12] Value={"Action":"sts:AssumeRole","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"}}].
      "Resources": {
       "SourceBucketKey79929454": {
        "Type": "AWS::KMS::Key",
@@ -388,7 +388,7 @@
          "S3Bucket": {
           "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
          },
-         "S3Key": "3423a042b818e31c1e34a19d6689ab2e5f9b70fcbe9e71df66f241b20a200bd9.zip"
+         "S3Key": "97e9ebf0b174a5c8f7faa505739022b7f509edddffcab9211dcd08b759944c4f.zip"
         },
         "Environment": {
          "Variables": {
-          Expand Down