NITRO-BOOT-01: The parent EC2 instance boots UEFI with NitroTPM¶
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
Example failures:
- The parent instance …. Secure Boot: ….
How to fix¶
- Launch the parent from an AMI registered with --boot-mode uefi and --tpm-support v2.0 on an instance type that supports NitroTPM, then enable UEFI Secure Boot by registering the AMI with a variable store that enrolls your PK, KEK and db keys.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No instance ID specified; skipping check.
ERROR:
- Could not describe instance: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--instance-id |
EC2 instance ID running the Nitro Enclave. |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | ec2.describe_instances |
ec2:DescribeInstances |
read |
| AWS | ec2.get_instance_uefi_data |
ec2:GetInstanceUefiData |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).