feat: expose service role to allow custom codebuild role for shellables

[colifran]

This PR exposes the underlying role property used to specify a role to be used by the CodeBuild project created as part of creating a new Shellable

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[kaizencc]

where is "a role will be created" happening?

[colifran]

This happens in the codebuild Project class - it's the behavior that happens currently. See: https://github.com/aws/aws-cdk/blob/8557c40ce3efb16cb6c6f4677540d38853937166/packages/aws-cdk-lib/aws-codebuild/lib/project.ts#L1045

[kaizencc]

Oh right. Okay, so the game plan is to send in our own serviceRole with similar permissions.

[colifran]

Exactly. It would look something like this:

private addSigning() {
    const signingBucket = Bucket.fromBucketArn(this, 'SigningBucket', config.signingBucketArn);
    const signingLambda = Function.fromFunctionArn(this, 'SigningFunction', config.signingLambdaArn);
    const accessRole = Role.fromRoleArn(this, 'AccessRole', config.signingAccessRoleArn);
    const serviceRole = new Role(this, 'SeviceRole', {
      roleName: 'signing-codebuild-role',
      assumedBy: new ServicePrincipal('codebuild.amazonaws.com'),
    });
    serviceRole.addToPolicy(new PolicyStatement({
      actions: ['sts:AssumeRole'],
      resources: [accessRole.roleArn],
    }));

    this.pipeline.signNuGetWithSigner({
      signingBucket,
      signingLambda,
      accessRole,
      serviceRole,
    });
  }