KMS-01: KMS key policy enforces RecipientAttestation¶

Property	Value
Severity	high
Platform	AWS Nitro Enclaves
Lifecycle stage	attest
Policy	P-03: Key release requires an attested measurement
Mode	Passive: read-only cloud API calls.

What a failure enables¶

RCE as root in enclave
Prod keys decrypted by any image

What it checks¶

It passes when:

All … Allow statement(s) granting an attestation-gated KMS operation enforce attestation on a code measurement: …
No Allow statement grants an attestation-gated KMS operation in the key policy.

Example failures:

… of … Allow statement(s) granting an attestation-gated KMS operation do not enforce meaningful attestation or scope access: ….
2 of 2 Allow+Decrypt statement(s) do not enforce meaningful attestation: 1 lack any RecipientAttestation condition; 1 bind only to identity PCRs (PCR3/PCR4), not to a code measurement (PCR0/1/2/8 or ImageSha384).

How to fix¶

Bind every such Allow statement to a real code measurement: StringEqualsIgnoreCase on kms:RecipientAttestation:ImageSha384 (PCR0) or PCR8 with the expected non-zero enclave/signing hash. Never leave all-zeros debug values in a production policy, and do not rely on PCR3/PCR4 alone — they identify the launcher, not the code. A NitroTPM condition (NitroTPMPCR4/7/12) binds the EC2 instance's boot, not the enclave image — pair it with a code measurement or replace it; never rely on it alone for enclave attestation. Scope those operations to the enclave's execution role; never grant it to a public principal (* / AWS:*). Remove or tightly scope kms:ReEncryptFrom and kms:CreateGrant — they bypass the attestation condition (a grant is not subject to the key policy's condition), and prefer explicit action names over kms:* / NotAction.
Bind every Allow+Decrypt statement to a real code measurement: StringEqualsIgnoreCase on kms:RecipientAttestation:ImageSha384 (PCR0) or PCR8 with the expected non-zero hash. Never leave all-zeros debug values in a production policy, and do not rely on PCR3/PCR4 alone.

After the fix, scan again: the check should report PASS.

When it is not assessed¶

SKIP:

No KMS key ID specified; skipping check.

ERROR:

Could not resolve KMS key: …
Could not retrieve key policy: …
Key policy is not valid JSON.

Scan inputs¶

The untrust scan options this check reads:

Option	Description
`--kms-key-id`	KMS key used to decrypt enclave secrets.
`--region`	AWS region.

Permissions¶

The cloud API calls this check makes, read from the scanner's source:

Cloud	API call	Permission	Access
AWS	`iam.list_roles`	`iam:ListRoles`	read
AWS	`iam.list_users`	`iam:ListUsers`	read
AWS	`iam.simulate_principal_policy`	`iam:SimulatePrincipalPolicy`	read
AWS	`kms.describe_key`	`kms:DescribeKey`	read
AWS	`kms.get_key_policy`	`kms:GetKeyPolicy`	read
AWS	`kms.list_grants`	`kms:ListGrants`	read

Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.

Runtime detection DET-02 (AWS Nitro Enclaves): kms:Decrypt without a RecipientAttestation context
Runtime detection DET-07 (AWS Nitro Enclaves): Attested key release to an unreleased enclave measurement
Runtime detection DET-08 (AWS Nitro Enclaves): Attestation condition removed from the key policy
Runtime detection DET-09 (AWS Nitro Enclaves): Grant created on the attestation-gated key
Runtime detection DET-10 (AWS Nitro Enclaves): Attested key release from an enclave on an unexpected host
Runtime detection DET-12 (AWS Nitro Enclaves): Attestation key disabled or scheduled for deletion
Runtime detection DET-13 (AWS Nitro Enclaves): Attestation measurement re-pinned in the key policy
Runtime detection DET-14 (AWS Nitro Enclaves): Attestation key alias repointed or deleted
Runtime detection DET-19 (AWS Nitro Enclaves): Data key generated without a RecipientAttestation context
Runtime detection DET-20 (AWS Nitro Enclaves): Attestation-gated key shared cross-account or made public
Runtime detection DET-21 (AWS Nitro Enclaves): Key administration granted to an external or wildcard principal
Runtime detection DET-H15 (Hardware fleets): Key released to an unregistered host
Other checks for policy P-03: CSPACE-KEYBIND-01, CSPACE-KEYBIND-03, CSPACE-KMS-01, CSPACE-KMS-02, GPUCC-BIND-01, GPUCC-DECRYPT-01, GPUCC-KEY-01, HSM-01, KBS-01, VAULT-01

Evidence recorded¶

Keys in the finding's evidence: conditions_found, identity_only, instance_attestation, key_arn, key_binding, no_condition, protected_keys, public_principal, release_matrix, release_path, total_decrypt_statements, total_statements

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).