Executive brief
Hulumi, a toolkit for deploying secure cloud infrastructure, contains a flaw in how it handles existing AWS security services. When configured to reuse existing GuardDuty or Security Hub setups, the software may fail to verify that security monitoring is actually active or may accidentally disable compliance monitoring during a routine system teardown. This can lead to a false sense of security where critical threat detection and compliance alerts are silently disabled or misconfigured.
Technical details
A protection mechanism failure (CWE-693) exists in the @hulumi/baseline package when using AccountFoundation's resource reuse paths. The toolkit failed to validate the operational state of imported GuardDuty detectors, allowing deployments to succeed even if threat detection was suspended or set to sub-optimal publishing frequencies. Additionally, Security Hub reuse paths lacked proper resource retention logic; a 'pulumi destroy' operation would trigger BatchDisableStandards, unintentionally unsubscribing the account from CIS/NIST compliance standards. Version 1.4.0 addresses these issues by asserting detector status at preview time and implementing 'retainOnDelete' for Security Hub subscriptions.
Affected products
- kerberosmansour @hulumi/baseline < 1.4.0
Timeline
- 2026-05-19: other: Fixes merged in pull request 178
- 2026-05-20: patched: Version 1.4.0 released
- 2026-07-24: disclosed: CVE published