Executive brief
AWS CDK is a framework for defining cloud infrastructure using code. When using the EKS cluster constructs, the service creates two roles (CreationRole and MastersRole) with trust policies that are overly permissive, allowing any AWS identity in the same account with broad assume-role permissions to impersonate them. An attacker with sufficient IAM permissions could exploit this to gain unauthorized access to Kubernetes cluster management or resource deployment capabilities.
Technical details
The vulnerability exists in AWS CDK's eks.Cluster and eks.FargateCluster constructs, which create IAM roles with trust policies that include the account root principal, effectively allowing any IAM identity in the account with sts:AssumeRole on "*" to assume these roles. The CreationRole (affected from v1.62.0+) is used by Lambda handlers to create and manage EKS clusters and Kubernetes resources; the default MastersRole (affected from v1.57.0+) grants kubectl command execution permissions. An attacker with a role having broad assume-role permissions could laterally escalate privileges to assume either role and gain cluster management access. The fix, released in v1.202.0 and v2.80.0, restricts trust policies to specific Lambda handler roles instead of the account root principal.
Affected products
- AWS CDK aws-cdk-lib >= 2.0.0, < 2.80.0; @aws-cdk/aws-eks >= 1.57.0, < 1.202.0; @aws-cdk/aws-eks >= 1.62.0 (CreationRole)
Timeline
- 2023-06-19: disclosed: GHSA-rx28-r23p-2qc3 published
- 2023-06-19: patched: Fixed in aws-cdk-lib v2.80.0 and @aws-cdk/aws-eks v1.202.0