custom-resource-handlers: IAM OIDC Provider reject unauthorized connection

[GavinZZ]

Describe the bug

The current implementation allows unauthorized connection in IAM OIDC Provider. These options lead to vulnerability, and should not be used. Although this code is run in a custom resource lambda handler and there shouldn't be any real impact, we should still follow the best practice to reject unauthorized connections.

packages/@aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts
❯❱ problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized
to false bypasses verification against the list of trusted CAs, which also leads to insecure
transport.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

Reject unauthorized OIDC connection

Current Behavior

Allow unauthorized OIDC connection

Reproduction Steps

N/A

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

any

Framework Version

No response

Node.js Version

Node 20

OS

MacOs

Language

TypeScript

Language Version

No response

Other information

No response

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.