Predictable AWS cloud deployment resources allow full account takeover

S3 bucket name-squatting

CDK is AWS’ open-source framework organizations use to define their infrastructure as code (IaC), the process of provisioning and managing computing resources by using code rather than configuring physical hardware manually, using programming languages like Python, TypeScript, or JavaScript.

In order to be able to use the AWS CDK, users need to bootstrap their environment to prepare it for CDK stack deployments. CDK bootstrapping creates a CloudFormation template file that deploys the essential infrastructure components, including access roles, configurations, policies, and an S3 staging bucket.

The created staging S3 bucket follows a specific naming pattern: cdk-{qualifier}-assets-(account-ID}-{Region}. The issue stems from the fact that users running the CDK bootstrap command rarely customize the “qualifier,” which is defaulted by AWS to “hnb659fds.”