DET-06: Enclave launched with --debug-mode¶
A debug enclave reports all-zero PCRs and exposes its console, which defeats attestation.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | AWS Nitro Enclaves |
| Group | tee |
| Log source | nitro-cli · host signal |
| Related check | ENCLAVE-01: Enclave debug mode is disabled |
Fires when¶
enclave launched with --debug-mode (nitro-cli run-enclave, debug=true)
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
This rule needs:
untrust detect --host-check: Also run nitro-cli on the host through SSM (DET-06, DET-11).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.