chore(deps): update dependency aws-cdk-lib to v2.80.0 [security] #315
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Diff Output: |
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
13 times, most recently
from
86bc7e4
to
62c983a
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
12 times, most recently
from
0cabc96
to
e5b2872
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
4 times, most recently
from
c382f8e
to
b26862f
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
15 times, most recently
from
12bffbf
to
70bd5eb
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
6 times, most recently
from
8717e86
to
ae71039
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
from
ae71039
to
c501722
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
from
c501722
to
015de3f
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
from
015de3f
to
9de758b
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
from
9de758b
to
9950195
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
from
9950195
to
81da803
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
from
81da803
to
3fad705
Compare
renovate
bot
force-pushed
the
renovate/npm-aws-cdk-lib-vulnerability
branch
from
3fad705
to
bec6035
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.74.0->2.80.0GitHub Vulnerability Alerts
CVE-2023-35165
If you are using the
eks.Clusteroreks.FargateClusterconstruct we need you to take action. Other users are not affected and can stop reading.Impact
The AWS Cloud Development Kit (CDK) allows for the definition of Amazon Elastic Container Service for Kubernetes (EKS) clusters.
eks.Clusterandeks.FargateClusterconstructs create two roles that have an overly permissive trust policy.The first, referred to as the CreationRole, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g
KubernetesManifest,HelmChart, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) will be affected.The second, referred to as the default MastersRole, is provisioned only if the
mastersRoleproperty isn't provided and has permissions to executekubectlcommands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) will be affected.Both these roles use the account root principal in their trust policy, which allows any identity in the account with the appropriate
sts:AssumeRolepermissions to assume it. For example, this can happen if another role in your account hassts:AssumeRolepermissions onResource: "*".CreationRole
Users with CDK version higher or equal to 1.62.0 (including v2 users). The role in question can be located in the IAM console. It will have the following name pattern:
*-ClusterCreationRole-*MastersRole
Users with CDK version higher or equal to 1.57.0 (including v2 users) that are not specifying the
mastersRoleproperty. The role in question can be located in the IAM console. It will have the following name pattern:*-MastersRole-*Patches
The issue has been fixed in versions v1.202.0, v2.80.0. We recommend you upgrade to a fixed version as soon as possible. See Managing Dependencies in the CDK Developer Guide for instructions on how to do this.
The new versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. This introduces some breaking changes that might require you to perform code changes. Refer to https://github.com/aws/aws-cdk/issues/25674 for a detailed discussion of options.
Workarounds
CreationRole
There is no workaround available for CreationRole.
MastersRole
To avoid creating the default MastersRole, use the
mastersRoleproperty to explicitly provide a role. For example:References
https://github.com/aws/aws-cdk/issues/25674
If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.
Release Notes
aws/aws-cdk (aws-cdk-lib)
v2.80.0Compare Source
⚠ BREAKING CHANGES
mastersRoleproperty to explicitly pass a role that needs cluster access. In addition, the creation role no longer allows any identity (with the appropriatests:AssumeRolepermissions) to assume it.Features
Bug Fixes
Alpha modules (2.80.0-alpha.0)
v2.79.1Compare Source
Bug Fixes
Alpha modules (2.79.1-alpha.0)
v2.79.0Compare Source
Features
Bug Fixes
[Object object](#25466) (b3d0d57), closes #25250Alpha modules (2.79.0-alpha.0)
Bug Fixes
[Object object](#25250) (b3d0d57)v2.78.0Compare Source
Features
aws/codebuild/amazonlinux2-aarch64-standard:3.0(#25351) (0d187c1), closes #25334Bug Fixes
variablesproperty onStageresource (#25267) (04427e3), closes #3635ManagedEc2EcsComputeEnvironmentinstance role missing managed policy (#25279) (c81d115), closes #25256Alpha modules (2.78.0-alpha.0)
v2.77.0Compare Source
Features
Bug Fixes
portproperty (#25112) (925c9ba), closes #22452BackupVault.fromBackupVaultArnparses wrong arn format (#25259) (c2082a7), closes #25212previous-parametersoption to bootstrap command (#25219) (02e8758), closes #23780Alpha modules (2.77.0-alpha.0)
v2.76.0Compare Source
⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
The user who are using these two method need to update to use alternative method.
For associateStack, the alternative method is associateApplicationWithStack
For associateAttributeGroup, the alternative method is AttributeGroup.associateWith
The user who are using these two method need to update to use alternative method. For associateStack, the alternative method is associateApplicationWithStack For associateAttributeGroup, the alternative method is AttributeGroup.associateWith
Purpose of this PR:
we need to remove deprecated resource before we moving into stable version The method that we remove is: associateStack and associateAttributeGroup
CHANGES:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license
Features
Bug Fixes
jobQueueNamereturns ARN instead of name (#25093) (a344507), closes #23018Alpha modules (2.76.0-alpha.0)
v2.75.1Compare Source
Reverts
Alpha modules (2.75.1-alpha.0)
v2.75.0Compare Source
Features
Alpha modules (2.75.0-alpha.0)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.