KMS-02: KMS grants do not bypass attestation¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | attest |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- No active grant confers a gated KMS operation (… grant(s) inspected).
Example failures:
- … of … KMS grant(s) confer a gated operation outside the key policy's attestation condition (grants cannot carry RecipientAttestation): ….
How to fix¶
- Retire grants that confer Decrypt/GenerateDataKey/DeriveSharedSecret/ReEncryptFrom/CreateGrant to a non-enclave principal (kms:RetireGrant / RevokeGrant). Grant key use only through a key-policy statement bound to kms:RecipientAttestation on a code measurement; a grant cannot express that condition, so it is always an un-attested path.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No KMS key ID specified; skipping check.
ERROR:
- Could not list KMS grants: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--kms-key-id |
KMS key used to decrypt enclave secrets. |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | kms.describe_key |
kms:DescribeKey |
read |
| AWS | kms.list_grants |
kms:ListGrants |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).