DET-C6: Key decrypted by a principal outside the workload identity pool¶
A Decrypt on the state key by an identity that did not federate through the attested pool. Needs Data Access (DATA_READ) audit logs for Cloud KMS.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | GCP Confidential Space |
| Group | tee |
| Log source | Cloud Audit Logs · Cloud KMS data access |
| Policy | P-03 |
| Related check | CSPACE-KMS-01: Cloud KMS decrypt is federated through the attested pool |
Fires when¶
cloudkms Decrypt AND caller principal NOT IN the workload identity pool
How it runs¶
untrust detect --platform sev-snp reads the project's Cloud Audit Logs over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.