Add Snyk Action to CodePipeline with CloudFormation

Question

I wanted to spin up a CodePipeline on AWS with a Snyk Scan action through CloudFormation. The official documentation on how to do this is a little light on details and seems to be missing key bits of information, so I was hoping someone could shed some light on this issue. According to the Snyk action reference, there are only several variables that need to be configured, so I followed along and setup my CodePipeline CF template with the following configuration,

- Name: Scan
  Actions:
    - Name: Scan
      InputArtifacts:
         - Name: "source"
      ActionTypeId:
         Category: Invoke
         Owner: ThirdParty
         Version: 1
         Provider: Snyk
      OutputArtifacts:
         - Name: "source-scan"

However, it is unclear how CodePipeline authenticates with Snyk with just this configuration. Sure enough, when I tried to spin up this template, I got the following error through the CloudFormation console,

Action configuration for action 'Scan' is missing required configuration 'ClientId'

I'm not exactly sure what the ClientId is in this case, but I assume it is the Snyk ORG id. So, I added ClientId under the Configuration section of the template. When I spun the new template up, I got the following error,

Action configuration for action 'Scan' is missing required configuration 'ClientToken'

Again, there is no documentation (that I could find) on the AWS side for what this ClientToken is, but I assume it is a Snyk API token, so I went ahead and added that. My final template looks like,

- Name: Scan
  Actions:
    - Name: Scan
      InputArtifacts:
         - Name: "source"
      ActionTypeId:
         Category: Invoke
         Owner: ThirdParty
         Version: 1
         Provider: Snyk
      OutputArtifacts:
         - Name: "source-scan"
      Configuration:
         ClientId: <id>
         ClientToken: <token>

The CloudFormation now goes up fine and without error, but the CodePipeline itself halts on the Scan stage, stalls for ten or so minutes and then outputs a error that doesn't give you much information,

There was an error in the scan execution.

I assume I am not authenticating with Snyk correctly. I can set up the scan fine through the console, but that includes an OAuth page where I enter my username/password before Snyk can authorize AWS. Anyway, I need to be able to set up the scan through CloudFormation as I will not have console for the project I am working on.

I am looking for a solution and/or some documentation that covers this use case. If anyone could point me in the right direction, I would be much obliged.