DET-C1: Attestation condition weakened on the workload identity provider¶
A Workload Identity provider was created or updated with an attribute condition that no longer pins dbgstat and the workload image digest: key release no longer depends on what code runs.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | GCP Confidential Space |
| Group | tee |
| Log source | Cloud Audit Logs · IAM |
| Policy | P-03 |
| Related check | CSPACE-KEYBIND-01: Confidential Space key release binds to a code measurement |
Fires when¶
Create/Update WorkloadIdentityPoolProvider AND attributeCondition fails attestation gating
How it runs¶
untrust detect --platform sev-snp reads the project's Cloud Audit Logs over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.