fix: ensure the admin role stabilizes for self-managed stacksets

src/stackset.ts

@@ -658,6 +658,10 @@ export class StackSet extends Resource implements IStackSet {
       stackInstancesGroup: Lazy.any({ produce: () => { return this.stackInstances; } }),
     });
 
+    if (this._role) {
+      stackSet.node.addDependency(this._role);
+    }
+
     // the file asset bucket deployment needs to complete before the stackset can deploy
     for (const fileAssetResourceName of fileAssetResourceNames) {
       const fileAssetResource = scope.node.tryFindChild(fileAssetResourceName);

test/integ.stack-set.ts.snapshot/integ-stackset-test.template.json

@@ -84,7 +84,8 @@
     "TemplateURL": {
      "Fn::Sub": "https://s3.test-region.${AWS::URLSuffix}/cdk-hnb659fds-assets-12345678-test-region/fc39dcfb61ca7db050a8c6cf440dde97c2c051f0965e9094eaad4bf1157e63cf.json"
     }
-   }
+   },
+   "DependsOn": ["AdminRoleDefaultPolicy1C2AB961", "AdminRole38563C57"]
   }
  },
  "Parameters": {
@@ -121,4 +122,4 @@
    ]
   }
  }
-}
+}

test/stack-set.test.ts

@@ -395,3 +395,28 @@ test('test lambda assets with two asset buckets', () => {
 
   Template.fromStack(stack).resourceCountIs('Custom::CDKBucketDeployment', 2);
 });
+
+test('test stackset depends on role', () => {
+  const app = new App();
+  const stack = new Stack(app);
+
+  new StackSet(stack, 'StackSet', {
+    target: StackSetTarget.fromAccounts({
+      regions: ['us-east-1'],
+      accounts: ['11111111111'],
+      parameterOverrides: {
+        Param1: 'Value1',
+      },
+    }),
+    template: StackSetTemplate.fromStackSetStack(
+      new StackSetStack(stack, 'Stack'),
+    ),
+  });
+
+  const role = Template.fromStack(stack).findResources('AWS::IAM::Role');
+  const defaultPolicy = Template.fromStack(stack).findResources('AWS::IAM::Policy');
+
+  Template.fromStack(stack).hasResource('AWS::CloudFormation::StackSet', {
+    DependsOn: [Object.keys(defaultPolicy)[0], Object.keys(role)[0]],
+  });
+});