CSPACE-KEYBIND-01: Confidential Space key release binds to a code measurement¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space (AMD SEV-SNP) |
| Lifecycle stage | attest |
| Policy | P-03: Key release requires an attested measurement |
| Mode | Passive: read-only cloud API calls. |
What a failure enables¶
- Workload keys released to tampered code
- Keys released to a debuggable workload
What it checks¶
It passes when:
- WIF provider condition binds key release to dbgstat=disabled-since-boot and a pinned image_digest.
Example failures:
- WIF provider has no attribute condition — any Confidential Space token admitted to the pool can release the key, regardless of debug status or workload image.
- WIF provider condition does not bind key release to a code measurement: it ….
How to fix¶
- Set an attribute condition on the WIF provider that binds every access to a code measurement, e.g.: assertion.swname == 'CONFIDENTIAL_SPACE' && assertion.dbgstat == 'disabled-since-boot' && assertion.submods.container.image_digest == 'sha256:<pinned-digest>' Pin the image_digest to your CI-built workload image, and prefer keeping support_attributes constrained so USABLE (debug-tooling) images are excluded. Binding only the audience/service account proves identity, not code.
- Pin assertion.submods.container.image_digest to your CI-built image and require assertion.dbgstat == 'disabled-since-boot' in the WIF provider attribute condition.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --wip-provider specified; skipping check.
ERROR:
- Could not read WIF provider condition: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--gcp-kms-key |
Cloud KMS key resource to audit IAM on. |
--wip-provider |
WIF provider resource gating key release. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| Google Cloud | iam.projects.locations.workloadIdentityPools.providers.get |
iam.workloadIdentityPoolProviders.get |
read |
See Required permissions for every check on this platform.
Related¶
- Runtime detection
DET-C1(GCP Confidential Space): Attestation condition weakened on the workload identity provider - Runtime detection
DET-C9(GCP Confidential Space): Attestation gate removed: identity provider or pool deleted - Other checks for policy P-03: CSPACE-KEYBIND-03, CSPACE-KMS-01, CSPACE-KMS-02, GPUCC-BIND-01, GPUCC-DECRYPT-01, GPUCC-KEY-01, HSM-01, KBS-01, KMS-01, VAULT-01
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).