CI/CD enterprise multi-account com CDK Pipelines

Accounts envolvidas:
  tools-account:     CodePipeline + CodeBuild + ECR + artifacts
  dev-account:       stacks de dev (auto-deploy)
  staging-account:   stacks de staging (auto-deploy)
  prod-account:      stacks de prod (manual approval)

Bootstrap CDK:
  Em cada conta-alvo, 'cdk bootstrap aws://ACCOUNT/REGION
  --trust TOOLS_ACCOUNT --cloudformation-execution-policies ...'
  cria IAM role que tools-account pode assumir pra deploy.

Pipeline (CDK):
  1. Source: CodeCommit/GitHub via CodeStar Connection
  2. Build: CodeBuild cdk synth → artifact cloud assembly
  3. SelfMutate: pipeline atualiza a si mesmo
  4. DevStage: deploy em dev-account (auto)
  5. IntegrationTests: CodeBuild smoke tests
  6. StagingStage: deploy em staging-account (auto)
  7. ManualApproval: SNS notifica team, espera aprovação
  8. ProdStage: deploy em prod-account
  9. PostProdValidation: CodeBuild valida + alarmes

import { Stack, StackProps, Stage, StageProps } from 'aws-cdk-lib';
import { CodePipeline, CodePipelineSource, ShellStep, ManualApprovalStep } from 'aws-cdk-lib/pipelines';

class AppStage extends Stage {
  constructor(scope: Construct, id: string, props: StageProps) {
    super(scope, id, props);
    new AppStack(this, 'AppStack', props);
  }
}

export class PipelineStack extends Stack {
  constructor(scope: Construct, id: string, props: StackProps) {
    super(scope, id, props);

    const pipeline = new CodePipeline(this, 'Pipeline', {
      pipelineName: 'app-pipeline',
      synth: new ShellStep('Synth', {
        input: CodePipelineSource.connection('org/repo', 'main', {
          connectionArn: 'arn:aws:codestar-connections:...',
        }),
        commands: ['npm ci', 'npm test', 'npx cdk synth'],
      }),
      crossAccountKeys: true,
    });

    pipeline.addStage(new AppStage(this, 'Dev', {
      env: { account: '111111111111', region: 'us-east-1' },
    }));

    pipeline.addStage(new AppStage(this, 'Staging', {
      env: { account: '222222222222', region: 'us-east-1' },
    }));

    pipeline.addStage(new AppStage(this, 'Prod', {
      env: { account: '333333333333', region: 'us-east-1' },
    }), {
      pre: [new ManualApprovalStep('PromoteToProd')],
    });
  }
}