DET-15: IMDS protection loosened on the enclave host¶
ModifyInstanceMetadataOptions re-enabled IMDSv1 (HttpTokens optional) or raised the hop limit on the host, making its instance credentials easier to steal.
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Group | cloud |
| Log source | CloudTrail · EC2 |
| Related check | IMDS-01: EC2 IMDSv2 enforcement |
Fires when¶
eventName == ModifyInstanceMetadataOptions AND (HttpTokens optional OR hop limit raised) AND instanceId == enclave_host
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.