Check reference¶
All 159 posture checks, grouped by the platform they first apply to. Each check has its own page: what a failure enables, how to fix it, the scan options it reads, the cloud permissions it needs, and when it is not assessed. A SKIP or ERROR result is not assessed and is never counted as a pass.
Source
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).
Verdicts¶
| Verdict | Meaning |
|---|---|
PASS |
The check ran and the configuration it reads meets the requirement. |
FAIL |
The check ran and found the weakness described below. Fix it, then rescan. |
SKIP |
NOT ASSESSED. The check did not run, usually because the scan was not given the input it needs (listed below) or the platform does not have the feature. A skipped check is never counted as a pass. |
ERROR |
NOT ASSESSED. The check started but could not reach a verdict, for example because an API call was denied or returned something unexpected. Fix the cause (listed below when known) and rescan; it is never counted as a pass. |
Summary¶
| Platform | Checks | Critical | High |
|---|---|---|---|
| AWS Nitro Enclaves | 46 | 3 | 25 |
| GCP Confidential Space (AMD SEV-SNP) | 33 | 1 | 24 |
| Azure confidential VMs | 6 | 3 | 3 |
| NVIDIA GPU Confidential Computing | 25 | 3 | 21 |
| Image registry | 9 | 2 | 5 |
| Hardware fleets (collector) | 25 | 6 | 16 |
| Intel TDX fleets | 5 | 2 | 3 |
| Intel SGX fleets | 5 | 2 | 3 |
| Arm CCA fleets | 5 | 2 | 3 |
AWS Nitro Enclaves¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| AUDIT-01 | low | S3 versioning and logging on state bucket | deploy | |
| BOOTSTRAP-01 | critical | Bootstrap supply chain — path traversal precondition | deploy | P-02 |
| BOOTSTRAP-02 | high | S3 bucket write scope | deploy | P-01 |
| CLOUDTRAIL-01 | medium | CloudTrail records enclave KMS and S3 operations | deploy | |
| CORE-01 | high | Core dump exposure | runtime | |
| DDB-01 | high | DynamoDB state table security | deploy | |
| DNS-01 | low | Host DNS DNAT rules | runtime | P-06 |
| EFS-01 | medium | EFS state filesystem security | deploy | |
| ENCLAVE-01 | critical | Enclave debug mode is disabled | attest | |
| ENCLAVE-02 | high | Enclave PCR measurements are non-zero | attest | |
| ENCLAVE-03 | medium | Multi-enclave co-tenancy | runtime | |
| ENCLAVE-04 | medium | Enclave booted from a signed image (PCR8) | attest | |
| ENCLAVE-05 | high | Enclave PCRs match the pinned golden baseline | attest | |
| ENCLAVE-06 | high | Enclave attestation document is nonce-bound and timestamped | attest | |
| ENCLAVE-07 | high | Enclave EIF is signed by an approved signer (PCR8 pinned) | attest | |
| ENV-01 | medium | Host-supplied configuration validation | runtime | P-06 |
| EXEC-01 | medium | State files lack execute permissions | runtime | |
| HOST-01 | medium | Sensitive file permissions on enclave host | runtime | |
| HOST-02 | medium | Enclave services running as root | runtime | |
| HSM-01 | high | Thales HSM releases keys only against a verified attestation | attest | P-03 |
| IAM-01 | high | Instance role least privilege | deploy | |
| IAM-02 | high | Instance role identity policy enforces KMS RecipientAttestation | attest | |
| IMDS-01 | high | EC2 IMDSv2 enforcement | deploy | |
| KBS-01 | high | CoCo KBS releases keys only against a verified attestation | attest | P-03 |
| KMS-01 | high | KMS key policy enforces RecipientAttestation | attest | P-03 |
| KMS-02 | high | KMS grants do not bypass attestation | attest | |
| LOG-01 | medium | Enclave log exposure | runtime | |
| NAT-01 | medium | IMDS blocked from enclave NAT egress | runtime | |
| NITRO-ATT-02 | critical | Captured attestation document is cryptographically verified | attest | P-04 |
| NITRO-ATT-03 | high | Attestation document binds this exchange and resists replay | attest | P-04 |
| NITRO-BOOT-01 | medium | The parent EC2 instance boots UEFI with NitroTPM | deploy | |
| NITRO-EGRESS-01 | high | Confidential host egress is not open to the internet | deploy | |
| PORT-01 | high | Unexpected listening TCP ports | runtime | |
| PROXY-01 | high | vsock-proxy egress allowlist is least-privilege | runtime | |
| RDS-01 | high | RDS/Aurora state database security | deploy | |
| RESTART-01 | high | Crash handler re-download persistence | runtime | |
| ROLLBACK-01 | medium | Anti-rollback protection on bootstrap state | deploy | |
| S3-01 | high | S3 public access block | deploy | |
| S3-02 | medium | State bucket encryption and TLS-only access | deploy | |
| SECRETS-01 | high | Secrets Manager secret security | deploy | |
| SSH-01 | high | Remote access hardening | runtime | |
| SSM-01 | high | SSM Parameter Store state security | deploy | |
| SWAP-01 | medium | Swap exposure | runtime | |
| VAULT-01 | high | HashiCorp Vault releases keys only against a verified attestation | attest | P-03 |
| VPC-01 | medium | VPC network isolation | deploy | |
| VSOCK-01 | medium | Vsock service exposure | runtime | P-06 |
GCP Confidential Space (AMD SEV-SNP)¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| CSPACE-ATT-01 | critical | Confidential Space token claims meet production policy | attest | P-04 |
| CSPACE-ATT-02 | high | Attestation token is cryptographically verified (signature/issuer/audience/freshness) | attest | P-04 |
| CSPACE-ATT-03 | high | Attestation token binds this deployment and resists replay/downgrade | attest | P-04 |
| CSPACE-AUDIT-01 | medium | Data-Access audit logs are enabled for KMS and Secret Manager | deploy | |
| CSPACE-BINAUTHZ-01 | high | Image signing is enforced for the workload image's repo | attest | P-09 |
| CSPACE-DEBUG-01 | high | Confidential Space runs the hardened production image with debug off | deploy | P-05 |
| CSPACE-EGRESS-01 | medium | Confidential VM network restricts egress by default | deploy | |
| CSPACE-IAM-INHERIT-01 | high | No sensitive role is granted to a public principal at a folder/org ancestor | deploy | |
| CSPACE-IMG-01 | high | Workload image signing is enforced and the registry is not plantable | attest | P-09 |
| CSPACE-IMG-02 | medium | Workload image registry is not world-readable | deploy | P-09 |
| CSPACE-INTEG-01 | high | The current boot passed Shielded VM integrity monitoring | deploy | |
| CSPACE-KEYBIND-01 | high | Confidential Space key release binds to a code measurement | attest | P-03 |
| CSPACE-KEYBIND-03 | medium | Confidential Space key release requires Secure Boot | attest | P-03 |
| CSPACE-KMS-01 | high | Cloud KMS decrypt is federated through the attested pool | attest | P-03 |
| CSPACE-KMS-02 | high | KMS decrypt is scoped to a workload attribute, not the whole pool | attest | P-03 |
| CSPACE-LAUNCH-01 | high | Workload launch policy forbids host env/command override | deploy | |
| CSPACE-LAUNCH-02 | high | Operator has not injected security-relevant env overrides (tee-env-*) | deploy | |
| CSPACE-LAUNCH-03 | high | Operator has not overridden the container command (tee-cmd) | deploy | |
| CSPACE-LAUNCH-04 | medium | Workload logs are not redirected to operator-readable logging | deploy | |
| CSPACE-LAUNCH-05 | medium | Workload does not auto-restart on failure (tee-restart-policy) | deploy | |
| CSPACE-META-01 | high | Confidential VM metadata is not broadly mutable | deploy | |
| CSPACE-ORG-01 | medium | Org policies forbid non-confidential VMs and exportable SA keys | deploy | |
| CSPACE-SA-01 | high | Workload SA cannot be impersonated to bypass attestation | deploy | |
| CSPACE-SAKEY-01 | high | Workload SA has no long-lived user-managed keys | deploy | |
| CSPACE-SECRET-01 | high | Secret Manager access is federated through the attested pool | attest | |
| CSPACE-SIGNER-01 | high | Attested workload image is signed by an approved signer | attest | |
| CSPACE-TOKEN-01 | high | Attestation token is issuer-pinned, audience-bound, and fresh | attest | |
| CSPACE-VM-01 | high | Confidential VM runs SEV-SNP with Shielded boot | deploy | |
| CSPACE-VM-02 | high | Confidential VM type is a recognized TEE and matches the attested hwmodel | deploy | |
| CSPACE-VPCSC-01 | medium | KMS / Secret Manager / GCS are inside a VPC Service Controls perimeter | deploy | |
| CSPACE-WIF-02 | high | All providers in the workload identity pool bind attestation | attest | |
| GCS-BOOT-01 | high | Bootstrap-state bucket hardening | deploy | |
| GCS-BOOT-02 | high | Bootstrap bucket rejects injection-shaped object writes | deploy |
Azure confidential VMs¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| AZ-BOOT-01 | high | Secure Boot and vTPM are on | deploy | |
| AZ-DBG-01 | critical | MAA attests the VM as non-debuggable and Azure-compliant | attest | |
| AZ-DISK-01 | high | OS disk uses confidential encryption with the guest state | deploy | |
| AZ-MAA-01 | high | Attestation policy cannot be rewritten through Azure RBAC | attest | |
| AZ-SKR-01 | critical | Key release policy is bound to attested, compliant confidential VMs | attest | |
| AZ-SKU-01 | critical | VM is a confidential VM on a confidential size | deploy |
NVIDIA GPU Confidential Computing¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| GPUCC-ATT-01 | critical | GPU attestation report asserts a trusted state | attest | P-04 |
| GPUCC-BIND-01 | high | The GPU attestation is cryptographically bound to the CVM | attest | P-03 |
| GPUCC-CERT-01 | high | Device certificate chain is validated to the NVIDIA root of trust | attest | |
| GPUCC-CUDA-01 | high | A CUDA kernel executes only after successful GPU attestation | runtime | |
| GPUCC-CVM-01 | high | GPU is attached to a verified Confidential VM (real TDX/SEV-SNP quote) | attest | |
| GPUCC-DECRYPT-01 | high | Model/data decryption occurs inside the TEE, not untrusted host RAM | attest | P-03 |
| GPUCC-DMA-01 | high | CPU<->GPU DMA is encrypted over an SPDM secure session | runtime | |
| GPUCC-FAILOPEN-01 | high | The verifier fails closed when attestation can't be checked | attest | |
| GPUCC-INPUT-01 | high | Model weights are loaded safely (not deserialized as code) | runtime | P-06 |
| GPUCC-KEY-01 | high | Model/data key and workload identity are not an attestation bypass | attest | P-03 |
| GPUCC-MEMHYG-01 | high | CVM memory hygiene: core dumps, swap, and ptrace cannot leak staged secrets | runtime | |
| GPUCC-MIG-01 | high | MIG partitions do not share the confidential GPU | runtime | |
| GPUCC-MODE-01 | high | GPU is in CC-On mode, not CC-DevTools or CC-Off | runtime | |
| GPUCC-MODEL-01 | high | Model/weights bootstrap store rejects injection-shaped object writes | deploy | |
| GPUCC-NONCE-01 | high | Attestation report is fresh (per-request nonce + expiry), not a replay | attest | |
| GPUCC-NVLINK-01 | high | The NVLink domain stays within the attested GPUs | runtime | |
| GPUCC-PERSIST-01 | high | Trust state does not survive a GPU reset un-re-attested | runtime | |
| GPUCC-READY-01 | critical | Workload attests before trusting the GPU (attestation-bound key release) | attest | |
| GPUCC-REATTEST-01 | high | Attestation is continuous, not one-shot (post-attest drift is caught) | attest | |
| GPUCC-REVOKE-01 | high | Device certificate revocation (OCSP/CRL) is checked and fails closed | attest | |
| GPUCC-RIM-01 | high | Verification pins RIM golden measurements (driver + VBIOS) | attest | |
| GPUCC-SIGVERIFY-01 | critical | The attestation report signature is cryptographically verified | attest | |
| GPUCC-TELEMETRY-01 | medium | Host-side GPU telemetry does not leak the confidential workload | runtime | |
| GPUCC-VMM-META-01 | high | The untrusted host cannot mutate the CVM/GPU launch configuration | deploy | |
| GPUCC-VRAM-01 | high | Hardware VRAM encryption is in effect | runtime |
Image registry¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| REG-ACCESS-01 | high | Artifact metadata is readable | supply | |
| REG-BIND-01 | high | Trusted and running measurements belong to verified artifacts | supply | |
| REG-DIGEST-01 | high | Resolved digest matches the released digest | supply | |
| REG-MEAS-01 | high | Enclave measurement matches the pinned PCR0 | supply | |
| REG-PIN-01 | medium | Deployment references immutable content | supply | |
| REG-PROV-01 | high | Build provenance matches the expected source and builder | supply | P-09 |
| REG-SIG-01 | critical | Artifact is signed | supply | P-09 |
| REG-SIG-02 | critical | Signature verifies against a trusted signer | supply | P-09 |
| REG-SIG-03 | medium | Signing certificate is not expired or about to expire | supply |
Hardware fleets (collector)¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| AZ-MEAS-01 | high | vTPM boot measurements match the fleet's PCR baseline | hardware | P-09 |
| BOOT-IN-01 | high | Boot inputs land where only root can replace them, and cannot execute | deploy | |
| BOOT-IN-02 | high | Boot inputs are fetched over an authenticated transport | deploy | |
| CCHOST-01 | high | SEV-SNP or TDX host support is enabled | hardware | |
| CCHOST-02 | high | SEV-SNP platform passes AMD's readiness checks (snphost ok) | hardware | |
| CCHOST-03 | medium | TPM has an endorsement key certificate | hardware | |
| CCHOST-04 | high | Kernel command line keeps confidential-computing protections on | hardware | |
| GPU-BIND-01 | high | GPU is bound to the host CVM in one attested upload | hardware | |
| GPU-CC-01 | critical | GPU runs in CC mode with debugging off | hardware | |
| GPU-CERT-01 | critical | GPU evidence is verified by NVIDIA | hardware | P-04 |
| GPU-FW-01 | medium | Driver and VBIOS have a current NVIDIA RIM | hardware | P-08 |
| GPU-KBS-01 | high | Key broker requires verified GPU evidence | hardware | |
| GPU-PPCIE-01 | high | GPU fabric runs a protected PCIe/NVLink path | hardware | |
| GPU-RIM-01 | high | GPU measurements match NVIDIA's reference values | hardware | P-09 |
| GPU-TOPO-01 | medium | GPU-NVSwitch topology is consistent across signed reports | hardware | |
| LAUNCH-01 | high | Guest launch measurement matches its declared launch inputs | hardware | |
| SE-CERT-01 | critical | Measurement is from a verified IBM Z Ultravisor | hardware | P-04 |
| SE-KEY-01 | high | Key broker releases keys only against a verified measurement | hardware | |
| SE-MEAS-01 | high | SE image is in the fleet's expected set | hardware | P-09 |
| SE-POL-01 | critical | SE image forbids confidential guest dumps | hardware | P-05 |
| SNP-CERT-01 | critical | SEV-SNP report is signed by genuine AMD hardware | hardware | P-04 |
| SNP-KEY-01 | high | Key broker releases keys only against a verified report | hardware | |
| SNP-MEAS-01 | high | Launch measurement is in the fleet's expected set | hardware | P-09 |
| SNP-POL-01 | critical | Guest policy forbids debug and migration agents | hardware | P-05 |
| SNP-TCB-01 | high | Reported TCB meets the fleet's minimum | hardware | P-08 |
Intel TDX fleets¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| TDX-CERT-01 | critical | TDX quote is signed by genuine Intel hardware | hardware | P-04 |
| TDX-KEY-01 | high | Key broker releases keys only against a verified quote | hardware | |
| TDX-MEAS-01 | high | MRTD is in the fleet's expected set | hardware | P-09 |
| TDX-POL-01 | critical | TD attributes forbid debug, migration and host-injected #VE | hardware | P-05 |
| TDX-TCB-01 | high | Intel rates the platform's TCB as acceptable | hardware | P-08 |
Intel SGX fleets¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| SGX-CERT-01 | critical | SGX quote is signed by genuine Intel hardware | hardware | P-04 |
| SGX-KEY-01 | high | Key broker releases keys only against a verified quote | hardware | |
| SGX-MEAS-01 | high | Enclave identity is in the fleet's expected set | hardware | P-09 |
| SGX-POL-01 | critical | Enclave is not debuggable and holds no privileged keys | hardware | P-05 |
| SGX-TCB-01 | high | Intel rates the platform's TCB as acceptable | hardware | P-08 |
Arm CCA fleets¶
| Check | Severity | Title | Stage | Policy |
|---|---|---|---|---|
| CCA-CERT-01 | critical | CCA token is signed by a trusted Arm CCA platform | hardware | P-04 |
| CCA-FW-01 | high | Platform firmware is in the fleet's expected set | hardware | P-08 |
| CCA-KEY-01 | high | Key broker releases keys only against a verified token | hardware | |
| CCA-MEAS-01 | high | Realm initial measurement is in the fleet's expected set | hardware | P-09 |
| CCA-POL-01 | critical | Platform is in the secured lifecycle state | hardware | P-05 |