DET-18: Internet ingress opened to the enclave host¶
AuthorizeSecurityGroupIngress opened one of the host's security groups to 0.0.0.0/0 or ::/0.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Group | cloud |
| Log source | CloudTrail · EC2 |
| Related | SG-01 |
Fires when¶
eventName == AuthorizeSecurityGroupIngress AND cidr == 0.0.0.0/0 AND security group attached to enclave_host
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.