DET-22: Enclave host disk imaged or snapshotted¶
CreateImage, CreateSnapshot or CreateSnapshots captured the enclave host's volumes. The host disk holds the bootstrap state, so an image or snapshot lifts it out of the instance's access controls (and can then be shared out).
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Group | cloud |
| Log source | CloudTrail · EC2 |
| Related check | BOOTSTRAP-02: S3 bucket write scope |
Fires when¶
eventName IN [CreateImage, CreateSnapshot, CreateSnapshots] AND volume/instance == enclave_host
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.