Executive brief
The AccountFoundation component of @hulumi/baseline manages AWS audit logging infrastructure, which is critical for compliance, forensics, and detecting unauthorized activity. The vulnerability allows audit logs stored in S3 to be deleted by users with S3 delete permissions, destroying the forensic trail—while organizations believe their audit logging is tamper-proof. This puts compliance-sensitive deployments at risk of undetectable privilege abuse or data theft, and could enable attackers to cover their tracks after gaining access to an AWS account.
Technical details
The vulnerability stems from CWE-1059 (Insufficient Technical Documentation / Behavioral Inconsistency) and comprises three independent weaknesses in how the AccountFoundation module configures S3 audit buckets: (1) the startup-hardened tier hard-coded objectLock: false despite intent to provide Write-Once-Read-Many (WORM) protection; (2) the forceDestroy flag was not restricted, allowing downstream stacks to set logBucketForceDestroy: true and purge all audit logs on Pulumi destruction; (3) sandbox-tier deployments skipped Object Lock, server access logging, and CloudTrail-Lake EventDataStore entirely, leaving no audit immutability. The fix in 1.4.0 enforces an invariant in SecureBucket that applies a deny-policy on s3:DeleteObject* for audit object prefixes, enables the CloudTrail-Lake EventDataStore regardless of tier, and blocks forceDestroy on startup-hardened buckets. The patch is available and users should upgrade immediately to prevent silent audit log deletion.
Affected products
- @hulumi @hulumi/baseline < 1.4.0
Timeline
- 2026-06-10: disclosed: Advisory GHSA-2mxr-p26x-mj73 published
- 2026-05-19: patched: Patch merged in PR #178; version 1.4.0 released