DET-A2: Secure Key Release policy no longer requires attestation¶
A key's release policy was created or updated without a Microsoft Azure Attestation authority, or without pinning the TEE claims (SEV-SNP measurement or TDX MRTD): the key releases to a VM whose code was never attested.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | Azure confidential VMs |
| Group | tee |
| Log source | Azure Key Vault · AuditEvent (KeyCreate/KeyUpdate) |
| Policy | P-03 |
| Related | AZURE-SKR-01 |
Fires when¶
Key Vault release policy update AND policy no longer requires MAA attestation
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.