AWS CDK CodeBuild S3 log encryption boolean inversion

Severity: low · CVSS 3.1 · Published 2026-07-24

AWS CDK is a framework for defining cloud infrastructure in code. A logic error in the CodeBuild module causes the S3 encryption setting to be inverted—when developers explicitly request encryption for build logs, the setting is actually disabled. While logs are generally encrypted by Amazon S3's default encryption (SSE-S3) since January 2023, older logs in buckets without default encryption configured could be stored unencrypted, exposing build log contents.

Technologies: aws-cdk-lib (npm). Vendors: Go, Maven, npm, NuGet.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.1, published 24 July 2026.
Which products and versions are affected?
github.com/aws/aws-cdk-go/awscdk (Go) SEMVER:introduced=1.175.0-devpreview,last_affected=1.204.0-devpreview; github.com/aws/aws-cdk-go/awscdk/v2 (Go) SEMVER:introduced=0,fixed=2.253.0; software.amazon.awscdk:aws-cdk-lib (Maven) ECOSYSTEM:introduced=0,fixed=2.253.0; software.amazon.awscdk:codebuild (Maven) ECOSYSTEM:introduced=1.75.0,last_affected=1.204.0; and 4 more.
Is there a fix for This vulnerability?
Yes. github.com/aws/aws-cdk-go/awscdk/v2 (Go): upgrade to 2.253.0 or later; software.amazon.awscdk:aws-cdk-lib (Maven): upgrade to 2.253.0 or later; aws-cdk-lib (npm): upgrade to 2.253.0 or later; Amazon.CDK.Lib (NuGet): upgrade to 2.253.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked with local access, in a software library.
Am I affected?
Check whether you run github.com/aws/aws-cdk-go/awscdk (Go), github.com/aws/aws-cdk-go/awscdk/v2 (Go), software.amazon.awscdk:aws-cdk-lib (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/aws/aws-cdk-go/awscdk/v2 (Go): upgrade to 2.253.0 or later
    go get github.com/aws/aws-cdk-go/awscdk/v2@v2.253.0
  • software.amazon.awscdk:aws-cdk-lib (Maven): upgrade to 2.253.0 or later
    # set software.amazon.awscdk:aws-cdk-lib to 2.253.0 in your pom.xml or build.gradle
  • aws-cdk-lib (npm): upgrade to 2.253.0 or later
    npm install aws-cdk-lib@2.253.0
  • Amazon.CDK.Lib (NuGet): upgrade to 2.253.0 or later
    dotnet add package Amazon.CDK.Lib --version 2.253.0

Technical details

The vulnerability is a boolean inversion logic error in the aws-codebuild module's S3LoggingOptions component. The CDK property uses positive polarity (encrypted: true means ON), but is directly mapped to CloudFormation's S3LogsConfig.EncryptionDisabled field, which uses negative polarity (true means OFF). The value is never negated during the mapping, causing inverted behavior: encrypted: true → EncryptionDisabled: true (encryption OFF), and encrypted: false → EncryptionDisabled: false (encryption ON). Users who omit the property are unaffected since undefined passes through and CloudFormation defaults to encryption enabled. The fix was merged in version 2.253.0 and requires upgrading or omitting the encrypted property entirely from S3LoggingOptions.

Affected products

  • AWS aws-cdk-lib < 2.253.0
  • AWS @aws-cdk/aws-codebuild >= 1.75.0
  • AWS aws-cdk.aws-codebuild >= 1.75.0
  • AWS Amazon.CDK.AWS.CodeBuild >= 1.75.0
  • AWS Amazon.CDK.Lib < 2.253.0
  • AWS github.com/aws/aws-cdk-go/awscdk/v2 < 2.253.0
  • AWS software.amazon.awscdk:aws-cdk-lib < 2.253.0
  • AWS software.amazon.awscdk:codebuild >= 1.75.0

Timeline

  • 2026-07-24: disclosed
  • 2026-05-06: patched: Version 2.253.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.