Hi Yang. The actual deployment is completed by the cdk execution role in the target account, so it is that role that must have permission to modify the bucket.

I have answered the stack overflow question for you with a little more detail.