Increase the minimum supported version of aws-cdk-lib to 2.80.0 #225

xiehan · 2023-07-12T09:02:20Z

Description

There is a moderate severity security alert for versions < 2.80.0; see: https://github.com/hashicorp/cdktf-aws-cdk/security/dependabot/22

However, note that currently, attempts to update aws-cdk-lib cause the example tests to fail; see: #178

At minimum, it seems like the snapshots used by the tests will need to be updated. However, we should also figure out if there are other breaking changes that our users will experience as a result of the upgrade and be as detailed as possible in the release notes about the anticipated impact.

References

‼️ NOTICE: eks overly permissive trust policies aws/aws-cdk#25674

Help Wanted

I'm interested in contributing a fix myself

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

xiehan · 2023-07-12T09:44:52Z

Since I just closed #178 because it was unnecessarily eating up GitHub Actions capacity, here is the test failure output for future reference:

FAIL ./main.test.ts (25.255 s)
  typescript-state-machine
    ✕ should synthesize (573 ms)

  ● typescript-state-machine › should synthesize

    expect(received).toMatchInlineSnapshot(snapshot)

    Snapshot name: `typescript-state-machine should synthesize 1`

    - Snapshot  - 2
    + Received  + 2

    @@ -45,11 +45,11 @@
              "type_name": "AWS::StepFunctions::StateMachine"
            }
          },
          "aws_iam_policy": {
            "adapter_StateMachineRoleDefaultPolicyDF1E6607_28877BB8": {
    -         "policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"lambda:InvokeFunction\", \"Effect\" = \"Allow\", \"Resource\" = jsondecode(aws_cloudcontrolapi_resource.adapter_GenerateID513CE4A3_C89CDB98.properties).Arn}, {\"Action\" = \"lambda:InvokeFunction\", \"Effect\" = \"Allow\", \"Resource\" = jsondecode(aws_cloudcontrolapi_resource.adapter_ReverseIDCAE3EB2F_3AAF546B.properties).Arn}], \"Version\" = \"2012-10-17\"})}"
    +         "policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"lambda:InvokeFunction\", \"Effect\" = \"Allow\", \"Resource\" = [jsondecode(aws_cloudcontrolapi_resource.adapter_GenerateID513CE4A3_C89CDB98.properties).Arn, join(\"\", [jsondecode(aws_cloudcontrolapi_resource.adapter_GenerateID513CE4A3_C89CDB98.properties).Arn, \":*\"])]}, {\"Action\" = \"lambda:InvokeFunction\", \"Effect\" = \"Allow\", \"Resource\" = [jsondecode(aws_cloudcontrolapi_resource.adapter_ReverseIDCAE3EB2F_3AAF546B.properties).Arn, join(\"\", [jsondecode(aws_cloudcontrolapi_resource.adapter_ReverseIDCAE3EB2F_3AAF546B.properties).Arn, \":*\"])]}], \"Version\" = \"2012-10-17\"})}"
            }
          },
          "aws_iam_role": {
            "adapter_GenerateIDServiceRoleF74DC5CE_608D8F11": {
              "assume_role_policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"sts:AssumeRole\", \"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = \"lambda.amazonaws.com\"}}], \"Version\" = \"2012-10-17\"})}",
    @@ -62,11 +62,11 @@
              "managed_policy_arns": [
                "${join(\"\", [\"arn:\", data.aws_partition.adapter_aws-partition_5B16AD9D.partition, \":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole\"])}"
              ]
            },
            "adapter_StateMachineRoleB840431D_34E24F0D": {
    -         "assume_role_policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"sts:AssumeRole\", \"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = join(\"\", [\"states.\", data.aws_region.adapter_aws-region_F8878EF0.name, \".amazonaws.com\"])}}], \"Version\" = \"2012-10-17\"})}"
    +         "assume_role_policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"sts:AssumeRole\", \"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = \"ServiceprincipalMap\"[data.aws_region.adapter_aws-region_F8878EF0.name].states}}], \"Version\" = \"2012-10-17\"})}"
            }
          },
          "aws_iam_role_policy_attachment": {
            "adapter_StateMachineRoleDefaultPolicyDF1E6607_role0_4C4F3BCD": {
              "policy_arn": "${aws_iam_policy.adapter_StateMachineRoleDefaultPolicyDF1E6607_[288](https://github.com/hashicorp/cdktf-aws-cdk/actions/runs/5529848199/jobs/10088466312?pr=178#step:12:289)77BB8.arn}",

      14 |     const synthResult = Testing.synth(stack);
      15 |
    > 16 |     expect(synthResult).toMatchInlineSnapshot(`
         |                         ^
      17 |       "{
      18 |         \\"data\\": {
      19 |           \\"aws_partition\\": {

      at Object.<anonymous> (main.test.ts:16:25)

 › 1 snapshot failed.

xiehan · 2023-07-21T10:51:37Z

Test failure output from #273:

FAIL ./main.test.ts (31.774 s)
  typescript-cron-lambda
    ✕ should synthesize (126 ms)

  ● typescript-cron-lambda › should synthesize

    expect(received).toMatchInlineSnapshot(snapshot)

    Snapshot name: `typescript-cron-lambda should synthesize 1`

    - Snapshot  - 1
    + Received  + 1

    @@ -21,11 +21,11 @@
          "aws_cloudcontrolapi_resource": {
            "adapter_lambda8B5974B5_06304D76": {
              "depends_on": [
                "time_sleep.adapter_lambdaServiceRole494E4CA6_sleep_lambdaServiceRole494E4CA6_738[47](https://github.com/hashicorp/cdktf-aws-cdk/actions/runs/5621274166/job/15231769948?pr=273#step:12:48)BDD"
              ],
    -         "desired_state": "${jsonencode({\"Code\" = {\"ZipFile\" = \"# Copyright (c) HashiCorp, Inc.\\n# SPDX-License-Identifier: MPL-2.0\\n\\ndef main(event, context):\\n    print(\\\"I'm running!\\\")\"}, \"Role\" = aws_iam_role.adapter_lambdaServiceRole[49](https://github.com/hashicorp/cdktf-aws-cdk/actions/runs/5621274166/job/15231769948?pr=273#step:12:50)4E4CA6_7D4D29EC.arn, \"Handler\" = \"index.main\", \"Runtime\" = \"python3.6\", \"Timeout\" = 300})}",
    +         "desired_state": "${jsonencode({\"Code\" = {\"ZipFile\" = \"# Copyright (c) HashiCorp, Inc.\\n# SPDX-License-Identifier: MPL-2.0\\n\\ndef main(event, context):\\n    print(\\\"I'm running!\\\")\"}, \"Handler\" = \"index.main\", \"Role\" = aws_iam_role.adapter_lambdaServiceRole494E4CA6_7D4D29EC.arn, \"Runtime\" = \"python3.6\", \"Timeout\" = 300})}",
              "type_name": "AWS::Lambda::Function"
            }
          },
          "aws_cloudwatch_event_rule": {
            "adapter_ruleF2C1DCDC_10BF9[62](https://github.com/hashicorp/cdktf-aws-cdk/actions/runs/5621274166/job/15231769948?pr=273#step:12:63)A": {

      14 |     const synthResult = Testing.synth(stack);
      15 |
    > 16 |     expect(synthResult).toMatchInlineSnapshot(`
         |                         ^
      17 |       "{
      18 |         \\"data\\": {
      19 |           \\"aws_partition\\": {

      at Object.<anonymous> (main.test.ts:16:25)

 › 1 snapshot failed.

xiehan · 2023-07-21T10:53:49Z

Test failure output from #275:

FAIL ./main.test.ts (37.44 s)
  typescript-state-machine
    ✕ should synthesize (698 ms)

  ● typescript-state-machine › should synthesize

    expect(received).toMatchInlineSnapshot(snapshot)

    Snapshot name: `typescript-state-machine should synthesize 1`

    - Snapshot  - 3
    + Received  + 3

    @@ -33,11 +33,11 @@
          "aws_cloudcontrolapi_resource": {
            "adapter_StateMachine2E01A3A5_637DDDC7": {
              "depends_on": [
                "time_sleep.adapter_StateMachineRoleB840431D_sleep_StateMachineRoleB840431D_89BC4BE8"
              ],
    -         "desired_state": "${jsonencode({\"RoleArn\" = aws_iam_role.adapter_StateMachineRoleB840431D_34E24F0D.arn, \"DefinitionString\" = join(\"\", [\"{\\\"StartAt\\\":\\\"Generate ID\\\",\\\"States\\\":{\\\"Generate ID\\\":{\\\"Next\\\":\\\"Wait 1 Second\\\",\\\"Retry\\\":[{\\\"ErrorEquals\\\":[\\\"Lambda.ServiceException\\\",\\\"Lambda.AWSLambdaException\\\",\\\"Lambda.SdkClientException\\\"],\\\"IntervalSeconds\\\":2,\\\"MaxAttempts\\\":6,\\\"BackoffRate\\\":2}],\\\"Type\\\":\\\"Task\\\",\\\"OutputPath\\\":\\\"$.Payload\\\",\\\"Resource\\\":\\\"arn:\", data.aws_partition.adapter_aws-partition_5B16AD9D.partition, join(\"\", [\":states:::lambda:invoke\\\",\\\"Parameters\\\":{\\\"FunctionName\\\":\\\"\", aws_lambda_function.generate-id_fn_99320B4B.arn, \"\\\",\\\"Payload.$\\\":\\\"$\\\"}},\\\"Wait 1 Second\\\":{\\\"Type\\\":\\\"Wait\\\",\\\"Seconds\\\":1,\\\"Next\\\":\\\"Reverse ID\\\"},\\\"Reverse ID\\\":{\\\"End\\\":true,\\\"Retry\\\":[{\\\"ErrorEquals\\\":[\\\"Lambda.ServiceException\\\",\\\"Lambda.AWSLambdaException\\\",\\\"Lambda.SdkClientException\\\"],\\\"IntervalSeconds\\\":2,\\\"MaxAttempts\\\":6,\\\"BackoffRate\\\":2}],\\\"Type\\\":\\\"Task\\\",\\\"OutputPath\\\":\\\"$.Payload\\\",\\\"Resource\\\":\\\"arn:\"]), data.aws_partition.adapter_aws-partition_5B16AD9D.partition, join(\"\", [\":states:::lambda:invoke\\\",\\\"Parameters\\\":{\\\"FunctionName\\\":\\\"\", aws_lambda_function.reverse-id_fn_A44557C2.arn, \"\\\",\\\"Payload.$\\\":\\\"$\\\"}}},\\\"TimeoutSeconds\\\":[300](https://github.com/hashicorp/cdktf-aws-cdk/actions/runs/5621392780/job/15232092378?pr=275#step:12:301)}\"])])})}",
    +         "desired_state": "${jsonencode({\"DefinitionString\" = join(\"\", [\"{\\\"StartAt\\\":\\\"Generate ID\\\",\\\"States\\\":{\\\"Generate ID\\\":{\\\"Next\\\":\\\"Wait 1 Second\\\",\\\"Retry\\\":[{\\\"ErrorEquals\\\":[\\\"Lambda.ServiceException\\\",\\\"Lambda.AWSLambdaException\\\",\\\"Lambda.SdkClientException\\\"],\\\"IntervalSeconds\\\":2,\\\"MaxAttempts\\\":6,\\\"BackoffRate\\\":2}],\\\"Type\\\":\\\"Task\\\",\\\"OutputPath\\\":\\\"$.Payload\\\",\\\"Resource\\\":\\\"arn:\", data.aws_partition.adapter_aws-partition_5B16AD9D.partition, join(\"\", [\":states:::lambda:invoke\\\",\\\"Parameters\\\":{\\\"FunctionName\\\":\\\"\", aws_lambda_function.generate-id_fn_99320B4B.arn, \"\\\",\\\"Payload.$\\\":\\\"$\\\"}},\\\"Wait 1 Second\\\":{\\\"Type\\\":\\\"Wait\\\",\\\"Seconds\\\":1,\\\"Next\\\":\\\"Reverse ID\\\"},\\\"Reverse ID\\\":{\\\"End\\\":true,\\\"Retry\\\":[{\\\"ErrorEquals\\\":[\\\"Lambda.ServiceException\\\",\\\"Lambda.AWSLambdaException\\\",\\\"Lambda.SdkClientException\\\"],\\\"IntervalSeconds\\\":2,\\\"MaxAttempts\\\":6,\\\"BackoffRate\\\":2}],\\\"Type\\\":\\\"Task\\\",\\\"OutputPath\\\":\\\"$.Payload\\\",\\\"Resource\\\":\\\"arn:\"]), data.aws_partition.adapter_aws-partition_5B16AD9D.partition, join(\"\", [\":states:::lambda:invoke\\\",\\\"Parameters\\\":{\\\"FunctionName\\\":\\\"\", aws_lambda_function.reverse-id_fn_A44557C2.arn, \"\\\",\\\"Payload.$\\\":\\\"$\\\"}}},\\\"TimeoutSeconds\\\":300}\"])]), \"RoleArn\" = aws_iam_role.adapter_StateMachineRoleB840431D_34E24F0D.arn})}",
              "type_name": "AWS::StepFunctions::StateMachine"
            }
          },
          "aws_cloudwatch_log_group": {
            "generate-id_snoop-log-group_D659273F": {
    @@ -49,11 +49,11 @@
              "retention_in_days": 7
            }
          },
          "aws_iam_policy": {
            "adapter_StateMachineRoleDefaultPolicyDF1E6607_28877BB8": {
    -         "policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"lambda:InvokeFunction\", \"Effect\" = \"Allow\", \"Resource\" = aws_lambda_function.generate-id_fn_99320B4B.arn}, {\"Action\" = \"lambda:InvokeFunction\", \"Effect\" = \"Allow\", \"Resource\" = aws_lambda_function.reverse-id_fn_A44557C2.arn}], \"Version\" = \"2012-10-17\"})}"
    +         "policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"lambda:InvokeFunction\", \"Effect\" = \"Allow\", \"Resource\" = [aws_lambda_function.generate-id_fn_99320B4B.arn, join(\"\", [aws_lambda_function.generate-id_fn_99320B4B.arn, \":*\"])]}, {\"Action\" = \"lambda:InvokeFunction\", \"Effect\" = \"Allow\", \"Resource\" = [aws_lambda_function.reverse-id_fn_A44557C2.arn, join(\"\", [aws_lambda_function.reverse-id_fn_A44557C2.arn, \":*\"])]}], \"Version\" = \"2012-10-17\"})}"
            },
            "generate-id_server-role_role-policy_6FBD6C53": {
              "name": "c8db9d[304](https://github.com/hashicorp/cdktf-aws-cdk/actions/runs/5621392780/job/15232092378?pr=275#step:12:305)1a90e1d114b187c0e984994c2bd27ae7b-role-policy",
              "path": "/",
              "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":[\"${aws_cloudwatch_log_group.generate-id_snoop-log-group_D659273F.arn}\",\"${aws_cloudwatch_log_group.generate-id_snoop-log-group_D659273F.arn}:log-stream:*\"],\"Effect\":\"Allow\"}]}"
    @@ -64,11 +64,11 @@
              "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":[\"${aws_cloudwatch_log_group.reverse-id_snoop-log-group_FAF8FFFD.arn}\",\"${aws_cloudwatch_log_group.reverse-id_snoop-log-group_FAF8FFFD.arn}:log-stream:*\"],\"Effect\":\"Allow\"}]}"
            }
          },
          "aws_iam_role": {
            "adapter_StateMachineRoleB840431D_34E24F0D": {
    -         "assume_role_policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"sts:AssumeRole\", \"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = join(\"\", [\"states.\", data.aws_region.adapter_aws-region_F8878EF0.name, \".amazonaws.com\"])}}], \"Version\" = \"2012-10-17\"})}"
    +         "assume_role_policy": "${jsonencode({\"Statement\" = [{\"Action\" = \"sts:AssumeRole\", \"Effect\" = \"Allow\", \"Principal\" = {\"Service\" = \"ServiceprincipalMap\"[data.aws_region.adapter_aws-region_F8878EF0.name].states}}], \"Version\" = \"2012-10-17\"})}"
            },
            "generate-id_server-role_62418FA4": {
              "assume_role_policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"sts:AssumeRole\",\"sts:SetSourceIdentity\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"lambda.amazonaws.com\"]}}]}",
              "name": "c8db9d3041a90e1d114b187c0e984994c2bd27ae7b"
            },

      14 |     const synthResult = Testing.synth(stack);
      15 |
    > 16 |     expect(synthResult).toMatchInlineSnapshot(`
         |                         ^
      17 |       "{
      18 |         \\"data\\": {
      19 |           \\"aws_partition\\": {

      at Object.<anonymous> (main.test.ts:16:25)

 › 1 snapshot failed.

Because of a security vulnerability in `aws-cdk-lib` prior to version 2.80.0, we are increasing the minimum required version to v2.80. See GHSA-rx28-r23p-2qc3 for the full CVE and impacts. > ### Who is affected? > #### MastersRole > Users with CDK version higher or equal to [1.57.0](https://github.com/aws/aws-cdk/releases/tag/v1.57.0) (including v2 users) that are not specifying the `mastersRole` property. The role in question can be located in the IAM console. It will have the following name pattern: > ``` > *-MastersRole-* > ``` > #### CreationRole > Users with CDK version higher or equal to [1.62.0](https://github.com/aws/aws-cdk/releases/tag/v1.62.0) (including v2 users). The role in question can be located in the IAM console. It will have the following name pattern: > ``` > *-ClusterCreationRole-* > ``` > ### Patches > The new versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. This introduces some breaking changes that might require you to perform code changes. Refer to aws/aws-cdk#25674 for a detailed discussion of options. > > ### Workarounds > #### CreationRole > There is no workaround available for CreationRole. > > #### MastersRole > To avoid creating the default MastersRole, use the `mastersRole` property to explicitly provide a role. For example: > > ```ts > new eks.Cluster(this, 'Cluster', { > ... > mastersRole: iam.Role.fromRoleArn(this, 'Admin', 'arn:aws:iam::xxx:role/Admin') > }); > ``` ### References [aws/aws-cdk#25674](aws/aws-cdk#25674) If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via their [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [email protected]. Closes #225

github-actions · 2023-09-25T02:27:12Z

I'm going to lock this issue because it has been closed for at least 30 days. This helps our maintainers find and focus on the active issues. If you've found a problem that seems similar to this, please open a new issue so we can investigate further.

xiehan added enhancement New feature or request backlog dependencies labels Jul 12, 2023

xiehan added this to the Limited Availability milestone Jul 12, 2023

xiehan mentioned this issue Jul 12, 2023

chore(deps): bump aws-cdk-lib from 2.0.0 to 2.87.0 in /examples/typescript-step-functions #178

Closed

xiehan added security and removed enhancement New feature or request labels Aug 25, 2023

xiehan mentioned this issue Aug 25, 2023

chore!: upgrade minimum required aws-cdk-lib version to 2.80.0 #399

Merged

xiehan removed this from the Limited Availability milestone Aug 25, 2023

xiehan closed this as completed in #399 Aug 25, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 25, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Increase the minimum supported version of aws-cdk-lib to 2.80.0 #225

Increase the minimum supported version of aws-cdk-lib to 2.80.0 #225

xiehan commented Jul 12, 2023

xiehan commented Jul 12, 2023

xiehan commented Jul 21, 2023

xiehan commented Jul 21, 2023

github-actions bot commented Sep 25, 2023

Increase the minimum supported version of aws-cdk-lib to 2.80.0 #225

Increase the minimum supported version of aws-cdk-lib to 2.80.0 #225

Comments

xiehan commented Jul 12, 2023

Description

References

Help Wanted

Community Note

xiehan commented Jul 12, 2023

xiehan commented Jul 21, 2023

xiehan commented Jul 21, 2023

github-actions bot commented Sep 25, 2023