Back to Checks
aws

CDKToolkit CloudFormation stack has Bootstrap version 21 or higher

cloudformation_stack_cdktoolkit_bootstrap_version
Service: cloudformationSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsCloudFormationStack

CloudFormation CDKToolkit stack's BootstrapVersion is compared to a recommended minimum (default 21). A lower value indicates the environment uses legacy bootstrap resources and IAM roles from older templates.

Prowler logoProwlerprowler-provider-aws

Risk

Outdated bootstrap stacks can lack recent hardening. Asset buckets or ECR repos may be easier to misuse, and deployment roles may have broader trust.

Adversaries could tamper artifacts or assume privileged roles, compromising integrity/confidentiality and enabling privilege escalation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudformation_stack_cdktoolkit_bootstrap_version

Recommendation

Standardize on the modern bootstrap at or above the recommended version (e.g., >= 21) in every account and Region.

Apply least privilege to bootstrap roles, limit trusted accounts, enable termination protection, and periodically review for version drift to strengthen defense in depth.

Remediation

CLI

cdk bootstrap aws://<ACCOUNT_ID>/<REGION>

Terraform

# Create/Update the CDKToolkit stack with BootstrapVersion >= 21
resource "aws_cloudformation_stack" "cdktoolkit" {
  name          = "CDKToolkit"
  # critical: template sets the BootstrapVersion output to 21 (or higher) so the check passes
  template_body = <<YAML
Resources:
  CdkBootstrapVersion:
    Type: AWS::SSM::Parameter
    Properties:
      Type: String
      Name: /cdk-bootstrap/hnb659fds/version  # critical: stores the bootstrap version
      Value: "21"                              # critical: version must be >= 21
Outputs:
  BootstrapVersion:
    Value: !GetAtt CdkBootstrapVersion.Value   # critical: exposes version via stack output
YAML
}

NativeIaC

# Minimal CloudFormation to expose BootstrapVersion >= 21 for CDKToolkit
# Deploy this template as a stack named "CDKToolkit"
Resources:
  CdkBootstrapVersion:
    Type: AWS::SSM::Parameter
    Properties:
      Type: String
      Name: /cdk-bootstrap/hnb659fds/version  # critical: stores the bootstrap version used by CDK
      Value: "21"                              # critical: set to 21 (or higher) to satisfy the check
Outputs:
  BootstrapVersion:
    Value: !GetAtt CdkBootstrapVersion.Value   # critical: exposes the version in stack outputs so the check passes

Other

1Sign in to the AWS Console and open CloudShell
2Run: cdk bootstrap aws://<ACCOUNT_ID>/<REGION>
3In the console, go to CloudFormation > Stacks > CDKToolkit > Outputs
4Confirm Output "BootstrapVersion" is 21 or higher

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudformation.cloudformation_client import (
    cloudformation_client,
)


class cloudformation_stack_cdktoolkit_bootstrap_version(Check):
    """Check if a CDKToolkit CloudFormation Stack has a Bootstrap version less than recommended"""

    def execute(self):
        """Execute the cloudformation_stack_cdktoolkit_bootstrap_version check"""
        findings = []
        recommended_cdk_bootstrap_version = cloudformation_client.audit_config.get(
            "recommended_cdk_bootstrap_version", 21
        )
        for stack in cloudformation_client.stacks:
            # Only check stacks named CDKToolkit
            if stack.name == "CDKToolkit":
                bootstrap_version = None
                if stack.outputs:
                    for output in stack.outputs:
                        if output.startswith("BootstrapVersion:"):
                            bootstrap_version = int(output.split(":")[1])
                            break
                if bootstrap_version:
                    report = Check_Report_AWS(metadata=self.metadata(), resource=stack)
                    report.status = "PASS"
                    report.status_extended = f"CloudFormation Stack CDKToolkit has a Bootstrap version {bootstrap_version}, which meets the recommended version."
                    if bootstrap_version < recommended_cdk_bootstrap_version:
                        report.status = "FAIL"
                        report.status_extended = f"CloudFormation Stack CDKToolkit has a Bootstrap version {bootstrap_version}, which is less than the recommended version {recommended_cdk_bootstrap_version}."

                    findings.append(report)

        return findings

References