ENV-01: Host-supplied configuration validation¶
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | runtime |
| Policy | P-06: Host-supplied inputs are authenticated |
| Mode | Active: runs fixed read-only commands on the host. Skipped with --read-only. |
What it checks¶
It passes when:
- No dangerous env vars found and files are properly restricted.
- No host-supplied environment files found (may be hardcoded in EIF).
Example failures:
- Dangerous env vars present: HTTPS_PROXY | Environment file is world-readable
How to fix¶
- Remove proxy-related and path-injection env vars from host-supplied configuration. Restrict env files to root-only (chmod 600). Implement a strict allowlist of permitted variable names with semantic validation of values (e.g., bucket names must match expected patterns).
- Remove proxy-related and path-injection env vars from host-supplied configuration. Restrict env files to root-only (chmod 600). Hardcode BUCKET_NAME and KEY_ARN in the EIF.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No instance ID specified; skipping check.
ERROR:
- SSM command did not complete within timeout.
- Could not send SSM command: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--instance-id |
EC2 instance ID running the Nitro Enclave. |
--region |
AWS region. |
--target-bucket |
S3 bucket holding the enclave's bootstrap state. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | ssm.get_command_invocation |
ssm:GetCommandInvocation |
read |
| AWS | ssm.send_command |
ssm:SendCommand |
run command |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Related¶
- Other checks for policy P-06: DNS-01, GPUCC-INPUT-01, VSOCK-01
Evidence recorded¶
Keys in the finding's evidence: dangerous_vars, infra_warnings, permissions, world_readable
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).