Executive brief
AWS CDK is a framework for defining cloud infrastructure in code. A logic error in the CodeBuild module causes the S3 encryption setting to be inverted—when developers explicitly request encryption for build logs, the setting is actually disabled. While logs are generally encrypted by Amazon S3's default encryption (SSE-S3) since January 2023, older logs in buckets without default encryption configured could be stored unencrypted, exposing build log contents.
Technical details
The vulnerability is a boolean inversion logic error in the aws-codebuild module's S3LoggingOptions component. The CDK property uses positive polarity (encrypted: true means ON), but is directly mapped to CloudFormation's S3LogsConfig.EncryptionDisabled field, which uses negative polarity (true means OFF). The value is never negated during the mapping, causing inverted behavior: encrypted: true → EncryptionDisabled: true (encryption OFF), and encrypted: false → EncryptionDisabled: false (encryption ON). Users who omit the property are unaffected since undefined passes through and CloudFormation defaults to encryption enabled. The fix was merged in version 2.253.0 and requires upgrading or omitting the encrypted property entirely from S3LoggingOptions.
Affected products
- AWS aws-cdk-lib < 2.253.0
- AWS @aws-cdk/aws-codebuild >= 1.75.0
- AWS aws-cdk.aws-codebuild >= 1.75.0
- AWS Amazon.CDK.AWS.CodeBuild >= 1.75.0
- AWS Amazon.CDK.Lib < 2.253.0
- AWS github.com/aws/aws-cdk-go/awscdk/v2 < 2.253.0
- AWS software.amazon.awscdk:aws-cdk-lib < 2.253.0
- AWS software.amazon.awscdk:codebuild >= 1.75.0
Timeline
- 2026-07-24: disclosed
- 2026-05-06: patched: Version 2.253.0 released