Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency aws-cdk-lib to v2.80.0 [security] #91

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency aws-cdk-lib to v2.80.0 [security] #91

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 20, 2023 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
aws-cdk-lib (source) 2.76.0 -> 2.80.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-35165

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading.

Impact

The AWS Cloud Development Kit (CDK) allows for the definition of Amazon Elastic Container Service for Kubernetes (EKS) clusters. eks.Cluster and eks.FargateCluster constructs create two roles that have an overly permissive trust policy.

The first, referred to as the CreationRole, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g KubernetesManifest, HelmChart, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) will be affected.

The second, referred to as the default MastersRole, is provisioned only if the mastersRole property isn't provided and has permissions to execute kubectl commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) will be affected.

Both these roles use the account root principal in their trust policy, which allows any identity in the account with the appropriate sts:AssumeRole permissions to assume it. For example, this can happen if another role in your account has sts:AssumeRole permissions on Resource: "*".

CreationRole

Users with CDK version higher or equal to 1.62.0 (including v2 users). The role in question can be located in the IAM console. It will have the following name pattern:

*-ClusterCreationRole-*

MastersRole

Users with CDK version higher or equal to 1.57.0 (including v2 users) that are not specifying the mastersRole property. The role in question can be located in the IAM console. It will have the following name pattern:

*-MastersRole-*

Patches

The issue has been fixed in versions v1.202.0, v2.80.0. We recommend you upgrade to a fixed version as soon as possible. See Managing Dependencies in the CDK Developer Guide for instructions on how to do this.

The new versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. This introduces some breaking changes that might require you to perform code changes. Refer to https://github.com/aws/aws-cdk/issues/25674 for a detailed discussion of options.

Workarounds

CreationRole

There is no workaround available for CreationRole.

MastersRole

To avoid creating the default MastersRole, use the mastersRole property to explicitly provide a role. For example:

new eks.Cluster(this, 'Cluster', { 
  ... 
  mastersRole: iam.Role.fromRoleArn(this, 'Admin', 'arn:aws:iam::xxx:role/Admin') 
});

References

https://github.com/aws/aws-cdk/issues/25674

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.80.0

Compare Source

⚠ BREAKING CHANGES
  • eks: A masters role is no longer provisioned by default. Use the mastersRole property to explicitly pass a role that needs cluster access. In addition, the creation role no longer allows any identity (with the appropriate sts:AssumeRole permissions) to assume it.
Features
Bug Fixes

Alpha modules (2.80.0-alpha.0)

v2.79.1

Compare Source

Bug Fixes
  • bootstrap: bootstrap doesn't work in non-aws partitions anymore (revert security hub finding fix) (#​25272) (4c4014e)

Alpha modules (2.79.1-alpha.0)

v2.79.0

Compare Source

Features
Bug Fixes

Alpha modules (2.79.0-alpha.0)

Bug Fixes
  • servicecatalogappregistry: Revert deprecated method to keep deprecated method in alpha version (b20b123)
  • batch: JobDefinition's ContainerDefinition's Image is synthesized with [Object object] (#​25250) (b3d0d57)

v2.78.0

Compare Source

Features
Bug Fixes

Alpha modules (2.78.0-alpha.0)

v2.77.0

Compare Source

Features
Bug Fixes

Alpha modules (2.77.0-alpha.0)

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented Jun 20, 2023

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

  • Branch has one or more failed status checks

@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 11 times, most recently from c3b7db6 to 8bda2d5 Compare June 27, 2023 04:46
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 16 times, most recently from 7c3ad0f to 88eb8e3 Compare July 4, 2023 09:05
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 2 times, most recently from 3d3af31 to 571a4a5 Compare July 6, 2023 04:52
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 5 times, most recently from deb24ba to baa9b93 Compare August 10, 2023 14:02
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from baa9b93 to b64d889 Compare November 11, 2023 18:38
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from b64d889 to 707ef3a Compare April 5, 2024 09:25
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 18 times, most recently from 3c705c1 to 7f3a179 Compare July 14, 2024 04:18
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 7f3a179 to b079573 Compare August 14, 2024 02:17
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch 2 times, most recently from accd438 to 0bc9f27 Compare August 28, 2024 03:48
@renovate renovate bot force-pushed the renovate/npm-aws-cdk-lib-vulnerability branch from 0bc9f27 to 259bd28 Compare October 19, 2024 21:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants