AWS CDK AND SAAS PROVIDER TAKEOVER

Summary from the TLDR InfoSec newsletter

AWS CDK requires users to bootstrap each environment, either manually or via the 'cdk bootstrap' command, which creates the necessary roles. These roles are configured by default to trust the current account's root principal. This can lead to a vulnerability when a SaaS provider requests an ARN from the user, which it provides to its proxy role to load data from the user's account. If the user provides the SaaS provider with an ARN from their own account, it will be implicitly trusted, exposing the SaaS provider's environment to the user.