Hulumi is an open‑source toolkit that provides secure‑by‑default cloud infrastructure components for Pulumi. Until version 1.4.0, an AccountFoundation deployment allowed an AWS account whose CloudTrail and Config audit logs were stored in an S3 bucket to be deleted by any principal with S3‑DeleteObject permissions, contrary to the hardened audit configuration that the platform promised. Because the audit logs could be erased, an attacker who could gain delete permissions could remove evidence of tampering or suspicious activity, undermining forensic integrity. The weakness is classified as CWE‑1059, indicating insufficient protection of tamper‑able audit data.

The affected product is the Hulumi toolkit developed by kerberosmansour, specifically the AccountFoundation feature. All releases prior to v1.4.0 are impacted, as the fix was introduced in that version. Users deploying the sandbox-tier or higher tiers that rely on the hardened audit configuration will be vulnerable.

The CVSS score of 7.1 classifies the issue as a high‑to‑moderate severity flaw. The EPSS score is below 1 %, indicating a low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would likely need credentials with S3 delete capabilities or a compromised IAM role; once achieved, they could delete the audit bucket, causing loss of audit data. The risk is primarily data loss and loss of forensic evidence rather than direct code execution.