title: AWS CodePipeline error: Cross-account pass role is not allowed
body: <p>I am trying to create an AWS CodePipeline that deploys the production code to a separate account. The code consists of a lambda function which is setup using a sam template and cloudformation. I have it currently deploying to the same account without error. I added another stage that has a manual approval action and after approval it should deploy to the other account. It fails with the following error:</p>
  
  <blockquote>
    <p>Cross-account pass role is not allowed (Service: AmazonCloudFormation; Status Code: 403; Error Code: AccessDenied; Request ID: d880bdd7-fe3f-11e7-8a8c-7dcffeae19ae)</p>
  </blockquote>
  
  <p>I have a role in the production account that has a trust relationship back to the dev account that has the pipeline. I gave the pipeline role and the production role administrator policies just to make sure it was not a policy issue. I edited the pipeline using the technique in this <a href="https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-create-cross-account.html" rel="noreferrer">walkthrough</a>. I am following the walkthrough loosely since they are setting their scenario up just slightly different from what I am doing.</p>
  
  <p>The deploy section in my pipeline looks like:</p>
  
  <pre><code>{
     "name": "my-stack",
     "actionTypeId": {
         "category": "Deploy",
         "owner": "AWS",
         "provider": "CloudFormation",
         "version": "1"
     },
     "runOrder": 2,
     "configuration": {
         "ActionMode": "CHANGE_SET_REPLACE",
             "Capabilities": "CAPABILITY_IAM",
         "ChangeSetName": "ProductionChangeSet",
         "RoleArn": "arn:aws:iam::000000000000:role/role-to-assume",
         "StackName": "MyProductionStack",
         "TemplatePath": "BuildArtifact::NewSamTemplate.yaml"
     },
     "outputArtifacts": [],
     "inputArtifacts": [
         {
             "name": "BuildArtifact"
        }
     ]
  }
  </code></pre>
  
  <p>I am able to assume into the role in the production account using the console. I am not sure how passrole is different but from everything I have read it requires the same assume role trust relationship.</p>
  
  <p>How can I configure IAM for cross account pipelines?</p>