Executive brief
AWS CDK is a framework for defining cloud infrastructure using code. When developers use the Cognito UserPoolClient construct to generate application secrets, those secrets were previously logged in full to CloudWatch Logs. Any authenticated user with read-only access to those logs could view and potentially misuse the secrets to authenticate as the application. Rotating secrets and upgrading CDK resolves the issue.
Technical details
The vulnerability is an information disclosure flaw in aws-cdk-lib's Cognito UserPoolClient construct. When the construct performs a DescribeCognitoUserPoolClient API call to retrieve generated client secrets, the full API response—including the plaintext secret—was written to the associated Lambda function's CloudWatch Logs. An attacker requires authentication in the AWS account and read-only permissions on the Lambda log group. The patch, released in version 2.187.0, disables logging of sensitive data by default; existing deployments must explicitly set the feature flag (@aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy, and rotate secrets in AWS Secrets Manager to eliminate exposure.
Affected products
- AWS aws-cdk-lib >2.37.0, <2.187.0
Timeline
- 2025-03-31: disclosed
- 2025-03-31: patched: Patches included in aws-cdk-lib v2.187.0