CLOUDTRAIL-01: CloudTrail records enclave KMS and S3 operations¶
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- … trail(s) logging; S3 data events captured. Enclave KMS and state operations are auditable.
Example failures:
- No CloudTrail trail covers this region. Enclave KMS Decrypt calls and S3 state operations are not being recorded — the KMS-interception and state-tampering attacks would be invisible.
- … trail(s) exist for this region but none are actively logging. KMS and S3 activity is not being captured.
- Management events are logged (KMS Decrypt is captured), but no trail records S3 object-level data events for the state bucket. Tampering with bootstrap state via GetObject/PutObject would leave no audit trail.
How to fix¶
- Create a multi-region CloudTrail trail with management events enabled, and add an S3 data-event selector for the state bucket.
- Start logging on the trail: aws cloudtrail start-logging --name <trail>.
- Add an S3 data-event selector scoped to the state bucket so object reads/writes are logged.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
ERROR:
- Could not describe CloudTrail trails: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--region |
AWS region. |
--target-bucket |
S3 bucket holding the enclave's bootstrap state. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | cloudtrail.describe_trails |
cloudtrail:DescribeTrails |
read |
| AWS | cloudtrail.get_event_selectors |
cloudtrail:GetEventSelectors |
read |
| AWS | cloudtrail.get_trail_status |
cloudtrail:GetTrailStatus |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Related¶
- Runtime detection
DET-17(AWS Nitro Enclaves): Audit trail stopped, deleted or narrowed
Evidence recorded¶
Keys in the finding's evidence: logging, logging_trails, s3_data_event_trails, trails_in_region
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).