To deploy from a pipeline account into a target account, the target must be bootstrapped to trust the pipeline: cdk bootstrap aws://TARGET/REGION --trust PIPELINE_ACCOUNT --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess.
Both flags matter. Without --trust the pipeline cannot assume the deploy role and fails with an AccessDenied naming a role like cdk-hnb659fds-deploy-role-ACCOUNT-REGION, which reads like a missing role rather than a missing trust. Without --cloudformation-execution-policies the bootstrap itself refuses, because trusting an account while giving CloudFormation no permissions would produce a target that can be reached and cannot deploy anything.
Trust is one-way and persists until you re-bootstrap without it. Anyone who can deploy from the trusted account effectively holds the execution policy in the target, so scope that policy rather than reaching for AdministratorAccess in production, and bootstrap each Region separately since the trust is per environment.