CSPACE-WIF-02: All providers in the workload identity pool bind attestation¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space (AMD SEV-SNP) |
| Lifecycle stage | attest |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- All … pool provider(s) bind Confidential Space attestation.
Example failures:
- … of … pool provider(s) do not bind Confidential Space attestation: …. A weaker sibling is a lateral key-release bypass.
- … of … pool provider(s) do not bind Confidential Space attestation — a weaker sibling is a lateral bypass.
How to fix¶
- Every provider in a pool that can reach the workload's resources must use the Confidential Space issuer and pin dbgstat + image_digest. Remove or scope any general-purpose / unconditioned sibling provider.
- Remove/scope any non-CS-issuer or unconditioned sibling provider.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --wip-provider specified; skipping check.
ERROR:
- Could not list pool providers: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--wip-provider |
WIF provider resource gating key release. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| Google Cloud | iam.projects.locations.workloadIdentityPools.providers.list |
iam.workloadIdentityPoolProviders.list |
read |
See Required permissions for every check on this platform.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).