S3-02: State bucket encryption and TLS-only access¶
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- Bucket has SSE-KMS default encryption and enforces TLS-only access.
Example failures:
- State bucket baseline issues: default encryption is AES256 (SSE-KMS recommended for a secrets bucket); no bucket policy denying non-TLS (aws:SecureTransport) access.
How to fix¶
- Enable default SSE-KMS encryption on the bucket and add a bucket policy Deny with Condition Bool aws:SecureTransport=false to force TLS.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No target bucket specified; skipping check.
ERROR:
- Could not read bucket encryption: …
- Could not read bucket policy: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--region |
AWS region. |
--target-bucket |
S3 bucket holding the enclave's bootstrap state. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | s3.get_bucket_policy |
s3:GetBucketPolicy |
read |
| AWS | s3.get_bucket_encryption |
s3:GetEncryptionConfiguration |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Evidence recorded¶
Keys in the finding's evidence: sse_algorithm, tls_only_deny
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).