Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Enclave-gated key setup V-036
Checks that enclave-gated keys require current attestation, and that enclave hosts have not drifted.
Checks
| Checks | Needs |
|---|---|
| Checks that a key an enclave host's role can decrypt with requires the enclave's attestation. | kms key, ec2 instance, iam instance profile |
| Checks that a key policy that asks for attestation names the enclave image it accepts. | kms key |
| Checks that an enclave host has not changed its image, role or metadata settings since the last run. | ec2 instance |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetPolicyVersion of the offending document → scope down by PR; reversible