title: What IAM permissions are needed to use CDK Deploy?
body: <p>My team has a pipeline which runs under an execution IAM role. We want to deploy code to AWS through CloudFormation or the CDK.</p>
  
  <p>In the past, we would upload some artifacts to S3 buckets before creating/updating our CloudFormation stack, using the execution IAM role.</p>
  
  <p>We recently switched to the CDK, and are trying to get as much automated with using CDK Deploy as possible, but are running into a lot of permission items we need to add which we didn't have prior (for instance, cloudformation:GetTemplate).</p>
  
  <p>We don't want to just grant * (we want to follow least privilege) but I can't find any clear documented list.</p>
  
  <p>Is there a standard list of permissions that CDK Deploy relies on? Are there any "nice to have's" beyond a standard list?</p>