S3 bucket word-squatting
CDK is the AWS open source framework organizations use to define their infrastructure as code (IaC), the process of providing and managing computing resources using code rather than configuring physical hardware by hand, using programming languages such as Python, TypeScript, or JavaScript.
To be able to use the AWS CDK, users need to bootstrap their environment to prepare it for CDK stack deployment. CDK bootstrapping creates a CloudFormation template file that deploys key infrastructure components, including access roles, configurations, policies, and an S3 staging bucket.
The created S3 staging bucket follows a specific naming pattern: cdk-{qualifier}-assets-(account-ID}-{Region}. The problem stems from the fact that users using the CDK bootstrap command rarely customize the “qualifier,” which is automatically set by AWS to “hnb659fds.”
Source link