diff --git a/samcli/lib/pipeline/bootstrap/stage_resources.yaml b/samcli/lib/pipeline/bootstrap/stage_resources.yaml
index b5aa9550219..bcc5e944235 100644
--- a/samcli/lib/pipeline/bootstrap/stage_resources.yaml
+++ b/samcli/lib/pipeline/bootstrap/stage_resources.yaml
@@ -105,6 +105,20 @@ Resources:
                   - !Ref PipelineUserArn
             Action:
               - 'sts:AssumeRole'
+          - Effect: Allow
+            Principal:
+              # Allow roles with tag Role=aws-sam-pipeline-codebuild-service-role to assume this role.
+              # This is required when CodePipeline is the CI/CD system of choice.
+              AWS:
+                - !If
+                  - MissingPipelineUser
+                  - !Ref AWS::AccountId
+                  - !Select [4, !Split [':', !Ref PipelineUserArn]]
+            Action:
+              - 'sts:AssumeRole'
+            Condition:
+              StringEquals:
+                aws:PrincipalTag/Role: aws-sam-pipeline-codebuild-service-role
 
   ArtifactsBucket:
     Type: AWS::S3::Bucket