DNS-01: Host DNS DNAT rules¶
| Property | Value |
|---|---|
| Severity | low |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | runtime |
| Policy | P-06: Host-supplied inputs are authenticated |
| Mode | Active: runs fixed read-only commands on the host. Skipped with --read-only. |
What it checks¶
It passes when:
- No DNS DNAT rules found. Enclave DNS is not redirected by the host.
Example failures:
- Found … DNS DNAT rule(s). The host redirects enclave DNS queries, enabling DNS-based MITM if TLS pinning is absent.
- Found 1 DNS DNAT rule(s). The host redirects enclave DNS queries, enabling DNS-based MITM if TLS pinning is absent.
How to fix¶
- If the enclave performs TLS certificate pinning, this is partially mitigated. Otherwise, the enclave should resolve DNS internally or use IP addresses directly for critical endpoints. Document the DNAT dependency and its security implications.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No instance ID specified; skipping check.
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--instance-id |
EC2 instance ID running the Nitro Enclave. |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | ssm.get_command_invocation |
ssm:GetCommandInvocation |
read |
| AWS | ssm.send_command |
ssm:SendCommand |
run command |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Related¶
- Other checks for policy P-06: ENV-01, GPUCC-INPUT-01, VSOCK-01
Evidence recorded¶
Keys in the finding's evidence: dnat_rules
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).