# AWS CDK CodePipeline overly broad IAM trust policy

Source: https://junglewise.ai/threats/aws-cdk-codepipeline-overly-broad-iam-trust-policy-41362db9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2025-03-24

AWS CDK's CodePipeline construct creates IAM roles with trust policies that are too permissive, allowing any authenticated user in the AWS account with sts:AssumeRole permissions to assume those roles. This could enable unauthorized access to pipeline resources including CloudFormation, CodeCommit, Lambda, ECS actions, and artifact storage in S3. The vulnerability requires the attacker to already be authenticated in the account and have unrestricted sts:AssumeRole permissions.

Technologies: [aws-cdk-lib (npm)](https://junglewise.ai/threats/technologies/aws-cdk-lib). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 24 March 2025.

**Which products and versions are affected?** aws-cdk-lib (npm) SEMVER:introduced=0,fixed=2.189.0.

**Is there a fix for This vulnerability?** Yes. aws-cdk-lib (npm): upgrade to 2.189.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run aws-cdk-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aws-cdk-lib (npm): upgrade to 2.189.0 or later

  ```sh
  npm install aws-cdk-lib@2.189.0
  ```


## Technical details

The AWS CDK CodePipeline construct creates multiple IAM roles to orchestrate software release processes. Two of these roles—the stage role and cross-account action role—are created with trust policies that permit the entire AWS account (account root principal) to assume them, rather than restricting assumption to specific pipeline roles or principals. The vulnerability is of class CWE-276 (Incorrect Default Permissions). An authenticated attacker with unrestricted sts:AssumeRole permissions in the target account can assume these overly-permissive roles and leverage any permissions they grant (CloudFormation stack management, CodeCommit access, Lambda invocation, ECS operations, or S3 artifact bucket access). Patches were released in CDK Construct Library v2.189.0, which introduces feature flags @aws-cdk/pipelines:reduceStageRoleTrustScope and @aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope. Existing applications must upgrade and enable these flags, then redeploy. Users who provide their own IAM role for CodePipeline are not affected.

## Affected products

- AWS aws-cdk-lib <2.189.0

## Timeline

- 2025-03-24: disclosed
- 2025-03-24: patched: Patch released in CDK Construct Library v2.189.0

## References

- [https://github.com/aws/aws-cdk/security/advisories/GHSA-5pq3-h73f-66hr](https://github.com/aws/aws-cdk/security/advisories/GHSA-5pq3-h73f-66hr)
- [https://github.com/aws/aws-cdk/issues/33709](https://github.com/aws/aws-cdk/issues/33709)
- [https://github.com/aws/aws-cdk/commit/a64b01cc2969822bb92d7bd72152ecb2ccf1c1cf](https://github.com/aws/aws-cdk/commit/a64b01cc2969822bb92d7bd72152ecb2ccf1c1cf)
- [https://github.com/aws/aws-cdk](https://github.com/aws/aws-cdk)
- [https://github.com/aws/aws-cdk/releases/tag/v2.184.0](https://github.com/aws/aws-cdk/releases/tag/v2.184.0)

## Related threats

- [AWS CDK CodeBuild S3 log encryption boolean inversion](https://junglewise.ai/threats/aws-cdk-codebuild-s3-log-encryption-boolean-inversion-53ea58e5)
- [AWS aws-cdk-lib OS command injection in NodejsFunction Docker bundling](https://junglewise.ai/threats/cve-2026-13760-aws-aws-cdk-lib-os-command-injection-in-nodejsfunction-docker)
- [AWS aws-cdk-lib OS command injection in NodejsFunction bundling](https://junglewise.ai/threats/cve-2026-11417-aws-aws-cdk-lib-os-command-injection-in-nodejsfunction-bundling)
- [AWS CDK permissions boundary aspect ordering vulnerability](https://junglewise.ai/threats/aws-cdk-permissions-boundary-aspect-ordering-vulnerability-e2cc5c58)
- [AWS CDK cognito.UserPoolClient secret logging to CloudWatch Logs](https://junglewise.ai/threats/aws-cdk-cognito-userpoolclient-secret-logging-to-cloudwatch-logs-47e1e91f)