Support matrix¶
What untrust covers on each platform, counted from the product's own catalogs.
Source
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).
Scanner (untrust scan)¶
| Platform | --platform |
Checks | Active checks | Cloud API | --demo |
|---|---|---|---|---|---|
| AWS Nitro Enclaves | nitro |
46 | 21 | AWS | yes |
| GCP Confidential Space (AMD SEV-SNP) | sev-snp |
33 | 1 | Google Cloud | yes |
| NVIDIA GPU Confidential Computing | gpu-cc |
25 | 1 | Google Cloud (active check only) | yes |
| Azure confidential VMs | azure-cvm |
6 | 0 | Azure | yes |
Evaluated from evidence¶
Checks the service evaluates from collector bundles or registry scans.
| Source | Checks |
|---|---|
| Image registry | 9 |
| Hardware fleets (collector) | 25 |
| Intel TDX fleets | 5 |
| Intel SGX fleets | 5 |
| Arm CCA fleets | 5 |
Read-only scans¶
The checks untrust scan --read-only leaves out, read from the scanner's selection. Each is recorded as SKIP, so the report still shows it was not assessed.
| Platform | Skipped with --read-only |
|---|---|
| AWS Nitro Enclaves | BOOTSTRAP-01, CORE-01, DNS-01, ENCLAVE-01, ENCLAVE-02, ENCLAVE-03, ENCLAVE-04, ENCLAVE-05, ENCLAVE-07, ENV-01, EXEC-01, HOST-01, HOST-02, LOG-01, NAT-01, PORT-01, PROXY-01, RESTART-01, SSH-01, SWAP-01, VSOCK-01 |
| GCP Confidential Space (AMD SEV-SNP) | GCS-BOOT-02 |
| NVIDIA GPU Confidential Computing | GPUCC-MODEL-01 |
| Azure confidential VMs | none |
Runtime detections¶
| Source | Rules | Critical | High |
|---|---|---|---|
| AWS Nitro Enclaves | 23 | 10 | 11 |
| Azure confidential VMs | 9 | 5 | 3 |
| GCP Confidential Space | 15 | 6 | 9 |
| Hardware fleets | 22 | 2 | 11 |
| Image registry | 4 | 0 | 3 |
| Key broker (KBS) | 2 | 1 | 1 |
| NVIDIA GPU CC | 7 | 3 | 2 |
CI gates¶
| Gate | Rules |
|---|---|
untrust buildscan (source analysis) |
55 |
untrust iacscan (infrastructure as code) |
65 |
IaC input formats: ARM template, CloudFormation, GCP Deployment Manager, Kubernetes, Terraform.