KMS enclave key has no authorization path that bypasses attestation
kms_key_enclave_attestation_bypassable_path
Detects bypass paths in enclave KMS key policies: Allow statements that grant sensitive KMS actions without a restrictive kms:RecipientAttestation:* condition and without a paired Deny that neutralizes the gap. Includes the common root-delegation shape (Principal: root, Action: kms:*) when it is not paired with an attestation Deny.
Risk
An attacker with IAM permission on the key can use the bypass path to access material without ever presenting a valid attestation document. Attestation-based access control is only as strong as the weakest authorization path in the key policy.
prowler aws --checks kms_key_enclave_attestation_bypassable_path
Recommendation
Treat every authorization path as equal: attestation-based access control is only as strong as the weakest Allow in the key policy. Add explicit Deny statements that fire when attestation is absent to close root-delegation gaps.
Remediation
aws kms put-key-policy --key-id <key-id> --policy-name default --policy file://enclave-policy.json
- Enumerate every Allow statement in the key policy; identify those granting sensitive actions (
kms:Decrypt,kms:GenerateDataKey, etc.) withoutkms:RecipientAttestation:*conditions. - Either add attestation conditions to those Allow statements, or add a Deny statement that fires when attestation is absent, e.g.:
{"Effect": "Deny", "Principal": "*", "Action": ["kms:Decrypt", ...], "Resource": "*", "Condition": {"Null": {"kms:RecipientAttestation:PCR0": "true"}}}. - Reject the common
AdminNoDataActionsshape when its action list containskms:*— split administrative actions from data-plane actions so the root delegation cannot reachkms:Decrypt.
Source Code
Resource Type
AwsKmsKey
References
Related To
- kms_key_enclave_attestation_not_enforced
- kms_key_enclave_debug_attestation_detected