HSM-01: Thales HSM releases keys only against a verified attestation

Property	Value
Severity	high
Platform	AWS Nitro Enclaves
Lifecycle stage	attest
Policy	P-03: Key release requires an attested measurement
Mode	Passive: reads only the files and values you pass to the scan.

How to fix

• Restrict HSM key use to the enclave identity: require the attestation-bound credential for unwrap/decrypt and remove host-held credentials that can use the key directly.

After the fix, scan again: the check should report PASS.

Permissions

None. The check reads only the files or values you pass to the scan.

Related

• Other checks for policy P-03: CSPACE-KEYBIND-01, CSPACE-KEYBIND-03, CSPACE-KMS-01, CSPACE-KMS-02, GPUCC-BIND-01, GPUCC-DECRYPT-01, GPUCC-KEY-01, KBS-01, KMS-01, VAULT-01

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).