title: Must cdk bootstrapping be done by a User with admin access?
body: <p>I am setting up a CDK application such that it can be deployed to multiple AWS accounts (dev and prod). The prod account was bootstrapped a few weeks ago by another developer but is working as expected by using a User called <code>CDKDeployUser</code> in a Group called <code>CDKDeployUsers</code> with attached Policy <code>CDKDeployPolicy</code>. The policy used (which works for all day to day CDK-related functions in the prod account) is:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;sts:AssumeRole&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:iam::*:role/cdk-*&quot;
              ]
          },
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;cloudformation:*&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:cloudformation:us-west-2:*:*&quot;
              ]
          }
      ]
  }
  </code></pre>
  <p>When I set up the dev account, I created a precisely identical User, Group, Policy and tried to run <code>cdk bootstrap</code> but I got errors about being able to assume a <code>cdk-*</code> related Role that didn't exist yet in the newly created account. I assumed that Cloudformation would create these roles as it did in the prod account but again, I don't know exactly how that account was bootstrapped.</p>
  <p>In order to &quot;just make it work&quot;, I added an Administrator policy to the <code>CDKDeployUsers</code> Group and ran <code>cdk bootstrap</code> and of course the bootstrap <em>did</em> create the necessary role that couldn't be used before.</p>
  <p><strong>So, is it a known thing that bootstrapping must be done by an administrator even though subsequent CDK actions can be performed with far fewer permissions?</strong></p>
  <p>I can't find it documented anywhere. It seems crazy that the expectation is for us to add an Admin policy every time we need to bootstrap (or upgrade the bootstrap templates as of CDK v2) and then detach them afterwards.</p>