GitLabのReview appsはMRパイプラインの構築がおすすめ

.cdk_review_job:
    image: node:lts
    stage: deploy
    rules:
      - if: $CI_MERGE_REQUEST_ID
    variables:
      ENV: $CI_COMMIT_REF_SLUG
      AWS_DEFAULT_REGION: us-east-1
    id_tokens:
      GITLAB_OIDC_TOKEN:
        aud: <https://gitlab.com>
    before_script:
      - uname -m
      # - curl "<https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip>" -o "awscliv2.zip"
      - curl "<https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip>" -o "awscliv2.zip"
      - unzip awscliv2.zip
      - ./aws/install
      - npm install -g aws-cdk 
      - aws --version
      - cdk --version
      - >
        export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
        $(aws sts assume-role-with-web-identity
        --role-arn ${ROLE_ARN}
        --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
        --web-identity-token ${GITLAB_OIDC_TOKEN}
        --duration-seconds 3600
        --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
        --output text))
      - aws sts get-caller-identity
      - npm i

cdk_deploy_review:
  extends:
    - .cdk_review_job
  environment:
      name: review/$CI_COMMIT_REF_SLUG
      on_stop: cdk_stop_review
  rules:
    - if: $CI_MERGE_REQUEST_ID
  script:
    - cdk synth
    - cdk diff
    - cdk deploy --require-approval never

cdk_stop_review:
  extends:
    - .cdk_review_job
  environment:
    name: review/$CI_COMMIT_REF_SLUG
    action: stop
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: manual
  script:
    - cdk destroy --force

cdk_deploy_review_branch_pipeline:
  extends:
   - .cdk_review_job
  environment:
    name: review/$CI_COMMIT_REF_SLUG/brahch_pipeline
    on_stop: cdk_stop_review_branch_pipeline
  rules:
    - if: $CI_COMMIT_BRANCH
  variables:
    ENV: "${CI_COMMIT_REF_SLUG}-brahch-pipeline"
  script:
   - cdk deploy --require-approval never

cdk_stop_review_branch_pipeline:
  extends:
    - .cdk_review_job
  environment:
    name: review/$CI_COMMIT_REF_SLUG/brahch_pipeline
    action: stop
  rules:
    - if: $CI_COMMIT_BRANCH
      when: manual
  variables:
    ENV: "${CI_COMMIT_REF_SLUG}-brahch-pipeline"
    # branchパイプラインのときは必要 <https://docs.gitlab.com/ee/ci/environments/index.html#stop-an-environment-when-a-branch-is-deleted>
    # GIT_STRATEGY: none
  script:
    - echo "gitリポジトリがもう削除されていて、checkout(pull)できないからそもそもエラーになる。つまりcdkコマンドは実行できない"
    - cdk destroy --force
    # 回避策としては、awscliのcfnでスタック名を指定して削除
    # 下記、スタック名をハードコードしているからより好ましいのは前段ジョブにてスタック名を抽出してartifactsにしてdependenciesで参照など
    # - aws cloudformation delete-stack --stack-name GitlabReviewAppWithTsCdkStack$ENV
  # 下記はaws cloudformation delete-stackのシナリオを試すときに有効にする必要あり（共通からnpm iを消したもの）
  # before_script:
  #     - curl "<https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip>" -o "awscliv2.zip"
  #     - unzip awscliv2.zip
  #     - ./aws/install
  #     - npm install -g aws-cdk 
  #     - >
  #       export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
  #       $(aws sts assume-role-with-web-identity
  #       --role-arn ${ROLE_ARN}
  #       --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
  #       --web-identity-token ${GITLAB_OIDC_TOKEN}
  #       --duration-seconds 3600
  #       --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
  #       --output text))