DET-23: Enclave host instance profile swapped¶
AssociateIamInstanceProfile or ReplaceIamInstanceProfileAssociation put a different IAM instance profile on the enclave host: the host now runs as another role, with whatever KMS and S3 access that role carries, without any change to the original role DET-16 watches.
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Group | cloud |
| Log source | CloudTrail · EC2 |
| Related check | IAM-01: Instance role least privilege |
Fires when¶
eventName IN [AssociateIamInstanceProfile, ReplaceIamInstanceProfileAssociation] AND instanceId == enclave_host AND profile changed
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.