Document what permissions the CDK needs.

The CDK v2 provides roles for this, and your user just needs to be able to assume those roles. You can look at the roles to see what actual permissions are required (it could conceivably change with updates).

The roles are created by bootstrapping, which is most easily done via admin access, but you can use a different account after that.

This Stack Overflow answer has the basics of assuming the roles: https://stackoverflow.com/a/61102280/416467