Junglewise Threat Intelligence

AWS CDK boolean inversion in CodeBuild S3LoggingOptions

Severity: low · CVSS 3.3 · Published 2026-07-24

Technologies: AWS CDK, aws-cdk-lib (npm). Vendors: AWS, NuGet, Maven, npm, Go.

Executive brief

The AWS Cloud Development Kit (CDK) contained a logic error that caused build logs in AWS CodeBuild to be stored without the intended encryption. When developers explicitly requested encryption for logs stored in Amazon S3, the system incorrectly disabled it due to a technical mismatch in how settings were processed. This could lead to sensitive build information being stored in a less secure manner than required by corporate policy, though logs created after January 2023 are still protected by default S3 encryption.

Technical details

A logic error in the `aws-codebuild` module of the AWS CDK caused a boolean inversion when configuring S3 log encryption. The `S3LoggingOptions.encrypted` property (where `true` means enabled) was mapped directly to the CloudFormation `S3LogsConfig.EncryptionDisabled` field (where `true` means disabled) without negation. Consequently, explicitly setting `encrypted: true` resulted in encryption being disabled in the resulting CloudFormation template. This vulnerability affects logs stored in S3 buckets; however, the impact is mitigated for objects created after January 5, 2023, due to mandatory S3 SSE-S3 encryption. The issue is resolved in `aws-cdk-lib` version 2.253.0 by properly negating the boolean value.

Affected products

  • AWS AWS CDK >= 1.75.0, <= 2.252.0
  • AWS aws-cdk-lib < 2.253.0

Timeline

  • 2026-05-05: patched: Pull request merged into main branch
  • 2026-07-22: disclosed: Initial advisory publication
  • 2026-07-24: advisory: GitHub Advisory reviewed and updated

References

Related threats