Indeed, I didn't find it all that hard to configure a role in the production account that has the permission to launch containers that the CI environment can as

Indeed, I didn't find it all that hard to configure a role in the production account that has the permission to launch containers that the CI environment can assume. I locked it down as much as possible but if the CI environment gets hacked someone could launch a container in the production environment. I did think of a way to make this more secure but I haven't done it yet - you could write a script that waits for input from a website where you have to log in via SAML. The script then passes the AWS credentials for the role back to the deployment task. Effectively, it's a second step authentication process where you'd need to be authenticated using a security key for the deployment to proceed. I haven't quite figured out all the details yet but that might help you get the assurance you need.