CSPACE-KMS-01: Cloud KMS decrypt is federated through the attested pool¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space (AMD SEV-SNP) |
| Lifecycle stage | attest |
| Policy | P-03: Key release requires an attested measurement |
| Mode | Passive: read-only cloud API calls. |
What a failure enables¶
- Workload keys released to tampered code
- Keys released to a debuggable workload
What it checks¶
It passes when:
- All KMS decrypt grants are federated through a Workload Identity pool.
Example failures:
- … decrypt grant(s) are not federated through a Workload Identity pool: …. Access does not require an attestation token.
How to fix¶
- Grant KMS decrypt only to a principalSet:// member scoped to the Confidential Space workload identity pool (ideally to a specific attribute), and remove allUsers/allAuthenticatedUsers and plain service-account grants.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --gcp-kms-key specified; skipping check.
ERROR:
- Could not read KMS key IAM policy: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--gcp-kms-key |
Cloud KMS key resource to audit IAM on. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| Google Cloud | cloudkms.projects.locations.keyRings.cryptoKeys.getIamPolicy |
cloudkms.cryptoKeys.getIamPolicy |
read |
See Required permissions for every check on this platform.
Related¶
- Runtime detection
DET-C12(GCP Confidential Space): Audit logging blinded by a logging sink or exclusion - Runtime detection
DET-C4(GCP Confidential Space): Key decrypt granted outside the attestation gate - Runtime detection
DET-C5(GCP Confidential Space): Attestation key version disabled or destroyed - Runtime detection
DET-C6(GCP Confidential Space): Key decrypted by a principal outside the workload identity pool - Runtime detection
DET-C8(GCP Confidential Space): Cloud KMS data access logging turned off - Other checks for policy P-03: CSPACE-KEYBIND-01, CSPACE-KEYBIND-03, CSPACE-KMS-02, GPUCC-BIND-01, GPUCC-DECRYPT-01, GPUCC-KEY-01, HSM-01, KBS-01, KMS-01, VAULT-01
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).