AUDIT-01: S3 versioning and logging on state bucket¶
| Property | Value |
|---|---|
| Severity | low |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- Bucket has versioning enabled and logging configured.
Example failures:
- S3 versioning is Disabled | S3 server access logging is disabled
How to fix¶
- Enable S3 versioning on the state bucket to prevent silent overwrites. Enable server access logging or CloudTrail S3 data events to create an audit trail of all object operations. Consider adding an S3 Object Lock retention policy for tamper-proof state integrity.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No target bucket specified; skipping check.
ERROR:
- Could not check bucket versioning: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--region |
AWS region. |
--target-bucket |
S3 bucket holding the enclave's bootstrap state. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | s3.get_bucket_logging |
s3:GetBucketLogging |
read |
| AWS | s3.get_bucket_versioning |
s3:GetBucketVersioning |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Evidence recorded¶
Keys in the finding's evidence: issues
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).