Skip to content

ROLLBACK-01: Anti-rollback protection on bootstrap state

Property Value
Severity medium
Platform AWS Nitro Enclaves
Lifecycle stage deploy
Mode Passive: read-only cloud API calls.

What it checks

It passes when:

  • S3 Object Lock enabled with default retention (… …). Bootstrap state is protected from rollback at rest.

Example failures:

  • S3 Object Lock is present but not enabled on the state bucket. Bootstrap state can be silently rolled back.
  • S3 Object Lock is enabled but no default retention rule is set, so new state objects are not protected by default.
  • No S3 Object Lock on the state bucket. An attacker with s3:PutObject can roll state back to an older version, which the enclave re-downloads and loads on its next restart.

How to fix

  • Enable Object Lock with a default retention rule.
  • Add a DefaultRetention rule (mode + period) so every state object version is retained and cannot be rolled back.
  • Enable S3 Object Lock (WORM) in COMPLIANCE or GOVERNANCE mode with a retention period on the state bucket. Object Lock requires versioning. This gives at-rest anti-rollback for bootstrap state. For strong freshness, also pin the expected version/digest from an external monotonic source the enclave verifies at boot.

After the fix, scan again: the check should report PASS.

When it is not assessed

SKIP:

  • No target bucket specified; skipping check.

ERROR:

  • Could not retrieve Object Lock configuration: …

Scan inputs

The untrust scan options this check reads:

Option Description
--region AWS region.
--target-bucket S3 bucket holding the enclave's bootstrap state.

Permissions

The cloud API calls this check makes, read from the scanner's source:

Cloud API call Permission Access
AWS s3.get_object_lock_configuration s3:GetBucketObjectLockConfiguration read

Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.

Evidence recorded

Keys in the finding's evidence: object_lock

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).