title: AWS CDK pipelines cross account source with codestar connections
body: <p>Looking to setup the source for my pipeline to be triggered from a codestar connection on a different AWS account.</p>
  <p>How can I use the CodeStarConnectionsSourceAction to connect to a cross account arn:aws:codestar-connections resource?</p>
  <p>The other account has the resource arn:aws:codestar-connections:us-west-2:connection/aEXAMPLE-8aad-4d5d-8878-dfcab0bc441f. It's all wired up and works.</p>
  <p>I create a policy of:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: {
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Action&quot;: [
              &quot;codestar-connections:PassConnection&quot;
          ],
          &quot;Resource&quot;: &quot;arn:aws:codestar-connections:us-west-2:connection/aEXAMPLE-8aad-4d5d-8878-dfcab0bc441f&quot;,
          &quot;Condition&quot;: {&quot;ForAllValues:StringEquals&quot;: {&quot;codestar-connections:PassedToService&quot;: &quot;codepipeline.amazonaws.com&quot;}}
      }
  }
  </code></pre>
  <p>And allow a trusted account to assume that role.</p>
  <p>Then I add:</p>
  <pre><code>const role = new iam.Role.fromARN(&quot;Role that allows assuming above policy from cross account&quot;);
  const sourceAction = new codepipeline_actions.CodeStarConnectionsSourceAction({
    connectionArn: &quot;arn:aws:codestar-connections:us-west-2:connection/aEXAMPLE-8aad-4d5d-8878-dfcab0bc441f&quot;,
    role: role,
  })
  </code></pre>
  <p>Then CodePipeline assumes that role so it can use that codestar connection? It fails to work that way because it tries to mutate the cross account role that's in the other account. Then if I out mutable false it losses permission to bucket.</p>