VPC-01: VPC network isolation¶
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- VPC is isolated: no public IP, no peering, no transit gateway.
Example failures:
- Enclave host has a public IP: 52.40.0.99 | 1 active VPC peering connection(s) found
How to fix¶
- The enclave host's VPC should be isolated. Remove VPC peering connections, transit gateway attachments, and public IPs from the enclave host. Use VPC endpoints for AWS service access.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No instance ID specified; skipping check.
ERROR:
- Instance … not found.
- Could not describe instance: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--instance-id |
EC2 instance ID running the Nitro Enclave. |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | ec2.describe_instances |
ec2:DescribeInstances |
read |
| AWS | ec2.describe_transit_gateway_vpc_attachments |
ec2:DescribeTransitGatewayVpcAttachments |
read |
| AWS | ec2.describe_vpc_peering_connections |
ec2:DescribeVpcPeeringConnections |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Evidence recorded¶
Keys in the finding's evidence: peering_connections, public_ip, vpc_id
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).