Why does the CDK CLI proceed if it can't assume the role?

[toadzky]

I'm getting a log message that says
current credentials could not be used to assume 'arn:aws:iam::########:role/cdk-qualifier-file-publishing-role-########-us-east-1', but are for the right account. Proceeding anyway.

It seems wrong that the CDK creates special roles to control what can be done on deploys but then ignores the fact that it can't assume those roles when run. Why doesn't it fail with an error? And why doesn't the --strict mode flag cause that at the very least?

[maciej-poleszczyk]

It's commented in the code:

https://github.com/aws/aws-cdk/blob/8b495f9ec157c0b00674715f62b1bbcabf2096ac/packages/aws-cdk/lib/api/aws-auth/sdk-provider.ts#L210C1-L213C80

But... I would also prefer to have option to disable that behaviour.