What is this about?

The AWS Cloud Development Kit (CDK) Team recently identified an issue with the CDK Pipelines construct library that may result in unintended permissions being granted to authenticated users in your account. As of April 4, 2023, we have fixed the issue in version 1.200.0 for CDK v1, and version 2.77.0 for CDK v2. We strongly recommend you upgrade to one of these versions as soon as possible. Please refer to the Managing Dependencies in the CDK Developer Guide for instructions on how to perform the upgrade.

What is the issue?

Starting with versions 1.158.0 and 2.26.0, released May 30, 2022, the library creates a role that allows every identity in the same account with sts:AssumeRole permissions on Resource: * to assume it. This may result in granting privileges to authenticated users in your account allowing them to take pipeline actions beyond what was intended.​

You can scan your CloudTrail log for sts:AssumeRole calls to the Role named <STACKNAME>-<PipelineConstructName>CodeBuildActionRole<RandomSuffix1>-<RandomSuffix2> in your CDK Pipeline account to determine if any unexpected access took place.

How do I know if I'm affected?

You are affected if you are using the pipelines.CodePipeline construct, and your version of:

• @aws-cdk/pipelines is between 1.158.0 and 1.199.0 (inclusive); OR
• aws-cdk-lib is between 2.26.0 and 2.76.0 (inclusive).

What should I do?

Please upgrade to the latest versions and redeploy your CDK pipelines.