Executive brief
AWS CDK's CodePipeline construct creates IAM roles with trust policies that are too permissive, allowing any authenticated user in the AWS account with sts:AssumeRole permissions to assume those roles. This could enable unauthorized access to pipeline resources including CloudFormation, CodeCommit, Lambda, ECS actions, and artifact storage in S3. The vulnerability requires the attacker to already be authenticated in the account and have unrestricted sts:AssumeRole permissions.
Technical details
The AWS CDK CodePipeline construct creates multiple IAM roles to orchestrate software release processes. Two of these roles—the stage role and cross-account action role—are created with trust policies that permit the entire AWS account (account root principal) to assume them, rather than restricting assumption to specific pipeline roles or principals. The vulnerability is of class CWE-276 (Incorrect Default Permissions). An authenticated attacker with unrestricted sts:AssumeRole permissions in the target account can assume these overly-permissive roles and leverage any permissions they grant (CloudFormation stack management, CodeCommit access, Lambda invocation, ECS operations, or S3 artifact bucket access). Patches were released in CDK Construct Library v2.189.0, which introduces feature flags @aws-cdk/pipelines:reduceStageRoleTrustScope and @aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope. Existing applications must upgrade and enable these flags, then redeploy. Users who provide their own IAM role for CodePipeline are not affected.
Affected products
- AWS aws-cdk-lib <2.189.0
Timeline
- 2025-03-24: disclosed
- 2025-03-24: patched: Patch released in CDK Construct Library v2.189.0