DET-16: Enclave host role permissions changed¶
An inline policy was written, a managed policy attached, or the trust policy changed on the enclave host's instance role.
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Group | cloud |
| Log source | CloudTrail · IAM (us-east-1) |
| Related check | IAM-01: Instance role least privilege |
Fires when¶
eventName IN [PutRolePolicy, AttachRolePolicy, PutRolePermissionsBoundary, UpdateAssumeRolePolicy] AND role == enclave_instance_role
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.