DET-11: Running enclave measurement differs from the released build¶
nitro-cli reports a PCR0 for the running enclave that is not a released build: the enclave was relaunched from a different image.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | AWS Nitro Enclaves |
| Group | tee |
| Log source | nitro-cli · host signal |
| Related check | ENCLAVE-01: Enclave debug mode is disabled |
Fires when¶
running enclave measurement (PCR0) != released build
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
This rule needs:
untrust detect --expected-pcr0: Released enclave image measurement (PCR0, hex); repeat for several builds. Enables DET-07 and DET-11.untrust detect --host-check: Also run nitro-cli on the host through SSM (DET-06, DET-11).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.