diff --git a/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts b/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
index f13834de16804..7e8155a62a6e8 100644
--- a/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
+++ b/packages/@aws-cdk/app-delivery/lib/pipeline-deploy-stack-action.ts
@@ -51,7 +51,7 @@ export interface PipelineDeployStackActionProps {
    *
    * @default A fresh role with admin or no permissions (depending on the value of `adminPermissions`).
    */
-  role?: iam.Role;
+  role?: iam.IRole;
 
   /**
    * Acknowledge certain changes made as part of deployment
@@ -97,7 +97,7 @@ export class PipelineDeployStackAction extends cdk.Construct {
   /**
    * The role used by CloudFormation for the deploy action
    */
-  public readonly role: iam.Role;
+  public readonly role: iam.IRole;
 
   private readonly stack: cdk.Stack;
 
diff --git a/packages/@aws-cdk/app-delivery/test/test.pipeline-deploy-stack-action.ts b/packages/@aws-cdk/app-delivery/test/test.pipeline-deploy-stack-action.ts
index 04e41a87540d4..3c5876a60a894 100644
--- a/packages/@aws-cdk/app-delivery/test/test.pipeline-deploy-stack-action.ts
+++ b/packages/@aws-cdk/app-delivery/test/test.pipeline-deploy-stack-action.ts
@@ -188,7 +188,7 @@ export = nodeunit.testCase({
       adminPermissions: false,
       role
     });
-    test.deepEqual(role.id, deployAction.role.id);
+    test.same(deployAction.role, role);
     test.done();
   },
   'users can specify IAM permissions for the deploy action'(test: nodeunit.Test) {
diff --git a/packages/@aws-cdk/aws-cloudformation/lib/pipeline-actions.ts b/packages/@aws-cdk/aws-cloudformation/lib/pipeline-actions.ts
index 450275efcec42..e8e1ee3fcbfe7 100644
--- a/packages/@aws-cdk/aws-cloudformation/lib/pipeline-actions.ts
+++ b/packages/@aws-cdk/aws-cloudformation/lib/pipeline-actions.ts
@@ -123,7 +123,7 @@ export interface PipelineCloudFormationDeployActionProps extends PipelineCloudFo
    *
    * @default A fresh role with full or no permissions (depending on the value of `adminPermissions`).
    */
-  role?: iam.Role;
+  role?: iam.IRole;
 
   /**
    * Acknowledge certain changes made as part of deployment
@@ -194,7 +194,7 @@ export interface PipelineCloudFormationDeployActionProps extends PipelineCloudFo
  * Base class for all CloudFormation actions that execute or stage deployments.
  */
 export abstract class PipelineCloudFormationDeployAction extends PipelineCloudFormationAction {
-  public readonly role: iam.Role;
+  public readonly role: iam.IRole;
 
   constructor(parent: cdk.Construct, id: string, props: PipelineCloudFormationDeployActionProps, configuration: any) {
     const capabilities = props.adminPermissions && props.capabilities === undefined ? CloudFormationCapabilities.NamedIAM : props.capabilities;
@@ -450,7 +450,7 @@ class SingletonPolicy extends cdk.Construct {
     }).addResource(stackArnFromProps(props));
   }
 
-  public grantPassRole(role: iam.Role): void {
+  public grantPassRole(role: iam.IRole): void {
     this.statementFor({ actions: ['iam:PassRole'] }).addResource(role.roleArn);
   }