AWS Nitro Enclaves

This guide takes you from no setup to a full scan of a Nitro Enclaves deployment: the parent EC2 instance, the store the enclave loads its state from, and the KMS key that should release secrets only to an attested enclave.

What gets checked: the bootstrap state store, the KMS key policy, the parent instance's host configuration, network egress and the running enclave's measurements. See the AWS Nitro Enclaves check list.

Before you begin

• Install the CLI: Install.
• Have AWS credentials for the account that runs the enclave. The scanner uses the standard AWS credential chain (environment variables, a profile, or an instance or workload role).
• For the host and enclave checks, the SSM agent must be running on the parent instance. Those checks run fixed commands, including nitro-cli, through SSM Run Command.

1. Try the demo

untrust scan --platform nitro --demo

The demo runs every check against a built-in, deliberately vulnerable simulated deployment. It contacts nothing and needs no credentials. Every result fails, which shows what each check reports:

[FAIL] BOOTSTRAP-02  No bucket policy exists. Any IAM principal with s3:PutObject permission can upload files to the state bucket.
[FAIL] IMDS-01       HttpTokens is 'optional' (should be 'required' for IMDSv2-only)
[FAIL] ENCLAVE-01    1 enclave(s) running in debug mode: i-0abc123-enc-0001. Attestation is disabled and the console is accessible.
...
33 of 33 checks failed.
Recorded results: 0 PASS, 33 FAIL, 0 SKIP, 0 ERROR. Skipped checks and errors remain unassessed.

2. Create a scanning identity

Create a dedicated IAM role or user for the scan, and attach the permissions in Required permissions › AWS Nitro Enclaves. That page is generated from the scanner's code. It has an example policy in three statements:

• UntrustScanRead: read-only describe and get calls. Every scan needs these.
• UntrustScanActive: s3:PutObject and s3:DeleteObject for the bootstrap write probe, and ssm:SendCommand for the host checks. Without it, the host checks report ERROR (not assessed). The write probe is then refused, so it shows only that the scanning identity cannot write; BOOTSTRAP-02 reads who else can.
• UntrustInventory: the extra reads for the console's inventory.

Scope the S3 actions to the state bucket, and ssm:SendCommand to the parent instance and the AWS-RunShellScript document.

3. Run your first scan

Name the parent instance, the state bucket and the KMS key:

untrust scan --platform nitro \
  --region <region> \
  --instance-id <parent-instance-id> \
  --target-bucket <state-bucket> \
  --kms-key-id <kms-key-id-or-alias> \
  --output report.json

You only need one target. Each check whose input you leave out reports SKIP.

4. Cover more checks

Each extra option turns on more checks:

If the enclave…	Add	Turns on
loads its state from DynamoDB, Secrets Manager, Parameter Store, EFS or RDS	--dynamodb-table, --secret-arn, --parameter-path, --efs-id, --db-instance	DDB-01, SECRETS-01, SSM-01, EFS-01, RDS-01
has known-good PCR values	--pcr-baseline baseline.json	ENCLAVE-05
produced an attestation document you captured	--nitro-attestation-doc doc.bin and --nitro-nonce <hex>	ENCLAVE-06, NITRO-ATT-02, NITRO-ATT-03
is built as a signed EIF	--nitro-approved-signers <pcr8>	ENCLAVE-07

Scan inputs lists every option and the checks that read it.

5. Read the results

• FAIL: open the check's page from the check list. Each page says what a failure enables and how to fix it. Fix the problem and scan again.
• SKIP: the check was not given its input. Each check's page lists its inputs and the reasons it can skip.
• ERROR: the check could not reach a verdict, usually because an API call was denied. Its page lists the permissions it needs.

SKIP and ERROR are never counted as a pass. The scan's exit code is 0 only when no check failed and none errored. See Output and exit codes.

6. Keep it running

• Upload the report to the console, or let the console scan the account through a cloud connection.
• Schedule untrust detect --platform nitro to read CloudTrail for runtime events such as a key released to an unexpected image. See Runtime detections.
• Compare two scans with untrust diff to catch regressions. See Drift between two scans.

Active checks and clean-up

The bootstrap write probe (BOOTSTRAP-01) writes probe objects to the state bucket and then removes them. The write and delete events appear in S3 data events and may alert GuardDuty. The host checks run commands that are logged in SSM. Run the scan from a dedicated audit identity, so these events are easy to tell apart from an attack.