Check ID: cloudformation_stack_cdktoolkit_bootstrap_version
Provider: AWS
Service: cloudformation
Severity: HIGH
Categories: vulnerabilities
Resource type: AwsCloudFormationStack

What this check verifies

CloudFormation CDKToolkit stack’s BootstrapVersion is compared to a recommended minimum (default 21). A lower value indicates the environment uses legacy bootstrap resources and IAM roles from older templates.

Risk

Outdated bootstrap stacks can lack recent hardening. Asset buckets or ECR repos may be easier to misuse, and deployment roles may have broader trust. Adversaries could tamper artifacts or assume privileged roles, compromising integrity/confidentiality and enabling privilege escalation.

Recommendation

Standardize on the modern bootstrap at or above the recommended version (e.g., >= 21) in every account and Region. Apply least privilege to bootstrap roles, limit trusted accounts, enable termination protection, and periodically review for version drift to strengthen defense in depth.

Remediation

cdk bootstrap aws://<ACCOUNT_ID>/<REGION>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudformation_stack_cdktoolkit_bootstrap_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks