CSPACE-KMS-02: KMS decrypt is scoped to a workload attribute, not the whole pool¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space (AMD SEV-SNP) |
| Lifecycle stage | attest |
| Policy | P-03: Key release requires an attested measurement |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- Federated KMS decrypt grants are scoped to a specific workload attribute.
Example failures:
- … KMS decrypt grant(s) bind the whole Workload Identity pool, not a specific workload attribute: …. Any attested workload in the pool can decrypt this key.
- … KMS decrypt grant(s) bind the whole Workload Identity pool — any attested workload in the pool can decrypt this key.
How to fix¶
- Scope the principalSet:// to a specific attribute, e.g. .../attribute.image_digest/sha256:<your-image>, so only your workload's attested identity — not every workload in the pool — can decrypt.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --gcp-kms-key specified; skipping check.
ERROR:
- Could not read KMS key IAM policy: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--gcp-kms-key |
Cloud KMS key resource to audit IAM on. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| Google Cloud | cloudkms.projects.locations.keyRings.cryptoKeys.getIamPolicy |
cloudkms.cryptoKeys.getIamPolicy |
read |
See Required permissions for every check on this platform.
Related¶
- Other checks for policy P-03: CSPACE-KEYBIND-01, CSPACE-KEYBIND-03, CSPACE-KMS-01, GPUCC-BIND-01, GPUCC-DECRYPT-01, GPUCC-KEY-01, HSM-01, KBS-01, KMS-01, VAULT-01
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).