DET-A1: Key release or decrypt granted outside the confidential VM's identity¶
A Key Vault access policy or role assignment gave a key's release/decrypt/unwrap to a principal other than the confidential VM's managed identity: that principal can obtain the key with no attestation.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | Azure confidential VMs |
| Group | tee |
| Log source | Azure Activity Log · Key Vault / RBAC |
| Policy | P-03 |
| Related | AZURE-SKR-01 |
Fires when¶
Key Vault key-release / decrypt grant AND grantee principalId != CVM managed identity
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.