DET-19: Data key generated without a RecipientAttestation context¶
GenerateDataKey or GenerateDataKeyPair on the attestation-gated key returned a plaintext data key to a caller that presented no enclave attestation: the same key-release bypass as DET-02, on the data-key path rather than Decrypt.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | AWS Nitro Enclaves |
| Group | tee |
| Log source | CloudTrail · KMS |
| Policy | P-03 |
| Related check | KMS-01: KMS key policy enforces RecipientAttestation |
Fires when¶
eventName IN [GenerateDataKey, GenerateDataKeyPair] AND keyId IN attested_keys AND recipient.attestationDocument IS NULL
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.