VAULT-01: HashiCorp Vault releases keys only against a verified attestation

Property	Value
Severity	high
Platform	AWS Nitro Enclaves
Lifecycle stage	attest
Policy	P-03: Key release requires an attested measurement
Mode	Passive: reads only the files and values you pass to the scan.

How to fix

• Require attestation-based auth for the enclave's Vault role (bind it to the enclave measurement), and remove static tokens or AppRole secrets the host could read.

After the fix, scan again: the check should report PASS.

Permissions

None. The check reads only the files or values you pass to the scan.

Related

• Other checks for policy P-03: CSPACE-KEYBIND-01, CSPACE-KEYBIND-03, CSPACE-KMS-01, CSPACE-KMS-02, GPUCC-BIND-01, GPUCC-DECRYPT-01, GPUCC-KEY-01, HSM-01, KBS-01, KMS-01

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).