Check ID:
Provider: AWS
Service:
Severity: HIGH
Categories:
Resource type:
cloudformation_stack_cdktoolkit_bootstrap_versionProvider: AWS
Service:
cloudformationSeverity: HIGH
Categories:
vulnerabilitiesResource type:
AwsCloudFormationStackWhat this check verifies
CloudFormation CDKToolkit stack’sBootstrapVersion is compared to a recommended minimum (default 21). A lower value indicates the environment uses legacy bootstrap resources and IAM roles from older templates.
Risk
Outdated bootstrap stacks can lack recent hardening. Asset buckets or ECR repos may be easier to misuse, and deployment roles may have broader trust. Adversaries could tamper artifacts or assume privileged roles, compromising integrity/confidentiality and enabling privilege escalation.Recommendation
Standardize on the modern bootstrap at or above the recommended version (e.g.,>= 21) in every account and Region.
Apply least privilege to bootstrap roles, limit trusted accounts, enable termination protection, and periodically review for version drift to strengthen defense in depth.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
cdk bootstrap aws://<ACCOUNT_ID>/<REGION>
References
- https://towardsthecloud.com/blog/aws-cdk-bootstrap
- https://support.icompaas.com/support/solutions/articles/62000233694-ensure-that-cdktoolkit-stacks-have-a-bootstrap-version-of-21-or-higher-to-mitigate-security-risks
- https://docs.aws.amazon.com/cdk/v2/guide/ref-cli-cmd-bootstrap.html
- https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping-customizing.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudformation_stack_cdktoolkit_bootstrap_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks