chore!: upgrade minimum required aws-cdk-lib version to 2.80.0

[xiehan]

Because of a security vulnerability in aws-cdk-lib prior to version 2.80.0, we are increasing the minimum required version to v2.80. See GHSA-rx28-r23p-2qc3 for the full CVE and impacts.

Who is affected?

MastersRole

Users with CDK version higher or equal to 1.57.0 (including v2 users) that are not specifying the mastersRole property. The role in question can be located in the IAM console. It will have the following name pattern:

*-MastersRole-*

CreationRole

Users with CDK version higher or equal to 1.62.0 (including v2 users). The role in question can be located in the IAM console. It will have the following name pattern:

*-ClusterCreationRole-*

Patches

The new versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. This introduces some breaking changes that might require you to perform code changes. Refer to aws/aws-cdk#25674 for a detailed discussion of options.

Workarounds

CreationRole

There is no workaround available for CreationRole.

MastersRole

To avoid creating the default MastersRole, use the mastersRole property to explicitly provide a role. For example:

new eks.Cluster(this, 'Cluster', { 
 ... 
 mastersRole: iam.Role.fromRoleArn(this, 'Admin', 'arn:aws:iam::xxx:role/Admin') 
});

References

aws/aws-cdk#25674

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via their vulnerability reporting page or directly via email to [email protected].

Closes #225

[github-actions]

I'm going to lock this pull request because it has been closed for at least 30 days. This helps our maintainers find and focus on the active issues. If you've found a problem that seems related to this change, please open a new issue so we can investigate further.