Executive brief
AWS CDK is a framework developers use to define cloud infrastructure in code. A change in version 2.172.0 altered the order in which configuration rules ("aspects") are applied to cloud resources. This can cause role permissions boundaries to be set incorrectly, potentially granting roles insufficient or unintended permissions. Applications running affected versions may have deployed infrastructure with incorrect security controls.
Technical details
This vulnerability is a logic error in aspect prioritization introduced in AWS CDK 2.172.0. The root cause is a new priority system that takes precedence over hierarchical location for aspect execution order. User-defined aspects are assigned DEFAULT priority (500) while CDK-internal aspects receive MUTATING priority (200), causing user aspects to execute last and override CDK-internal overrides. An attacker with the ability to define custom aspects or control CDK application code could craft a malicious aspect to apply overly permissive or restrictive permissions boundaries to IAM roles. The vulnerability requires high privilege and complexity to exploit. The issue is fixed in version 2.189.1 with a feature flag to restore legacy behavior.
Affected products
- AWS CDK 2.172.0 to 2.189.0
Timeline
- 2025-04-15: disclosed