DDB-01: DynamoDB state table security¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- DynamoDB state table uses a customer-managed CMK, PITR, deletion protection, a resource policy, and is audited.
How to fix¶
- Encrypt the table with a customer-managed KMS CMK and gate that key on enclave attestation (KMS-01); enable point-in-time recovery and deletion protection; attach a resource-based policy restricting PutItem to the enclave role; and add a CloudTrail data-event selector for the table.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No DynamoDB table specified; skipping check.
ERROR:
- Could not describe DynamoDB table: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--dynamodb-table |
DynamoDB table holding enclave bootstrap state (alternative to S3). |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | cloudtrail.describe_trails |
cloudtrail:DescribeTrails |
read |
| AWS | cloudtrail.get_event_selectors |
cloudtrail:GetEventSelectors |
read |
| AWS | cloudtrail.get_trail_status |
cloudtrail:GetTrailStatus |
read |
| AWS | dynamodb.describe_continuous_backups |
dynamodb:DescribeContinuousBackups |
read |
| AWS | dynamodb.describe_table |
dynamodb:DescribeTable |
read |
| AWS | dynamodb.get_resource_policy |
dynamodb:GetResourcePolicy |
read |
| AWS | kms.describe_key |
kms:DescribeKey |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).