DET-04: Interactive access attempt on the enclave host¶
SendSSHPublicKey or an SSM session on the hardened host.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Group | cloud |
| Log source | CloudTrail · EC2 Instance Connect / SSM |
| Related check | SSH-01: Remote access hardening |
Fires when¶
interactive access (SSM StartSession / SSH) targets the enclave host
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.