Add the CloudFormation ContinueUpdateRollback permission to the pivotRole, for administrative use

[rbernotas]

Is your idea related to a problem? Please describe.

We would like to add the following permission to the pivotRole:

cloudformation:ContinueUpdateRollback

...so that as a data.all administrator, we can trigger the Continue Update Rollback from the data.all infra account (while assuming the pivotRole) on environment stacks for environments that are bootstrapped to the data.all infra account.

We had a situation where a missing lambda permission in the CDK Exec Role policy caused all of our linked environments to go into the Update Rollback Failed state. While we have some automation to help users to update the permissions in that policy, it is more cumbersome (and not scalable) to get them to go into their accounts to trigger the Continue Update Rollback. Ideally we can add this permission to the pivotRole, so that we can most easily script from the admin account automatically getting the environments back to the successful rollback state, before the next environment update is applied.

Describe the solution you'd like

Add the cloudformation:ContinueUpdateRollback to the pivotRole.

P.S. Don't attach files. Please, prefer add code snippets directly in the message body.