KMS enclave key requires kms:RecipientAttestation conditions on sensitive actions
kms_key_enclave_attestation_not_enforced
Customer-managed KMS keys used with Nitro Enclaves (identified by prowler:enclave-key=true tag, enclave in description/tags/aliases, or a policy referencing kms:RecipientAttestation:*). Every Allow on sensitive actions (kms:Decrypt, DeriveSharedSecret, GenerateDataKey*, GenerateRandom, kms:*, *) must require a kms:RecipientAttestation:* condition.
Risk
Without an attestation condition, any principal with decrypt permission (including a compromised parent instance) can use the key. Attestation is the cryptographic mechanism that binds usage to the measured enclave image; its absence removes the trust boundary the enclave was designed to enforce.
prowler aws --checks kms_key_enclave_attestation_not_enforced
Recommendation
Bind every sensitive grant on enclave-scoped KMS keys to the enclave's measured identity via kms:RecipientAttestation:* conditions. This preserves the trust boundary the enclave exists to enforce and prevents any non-enclave principal from using the key.
Remediation
aws kms put-key-policy --key-id <key-id> --policy-name default --policy file://enclave-policy.json
- Enumerate the customer-managed keys used by enclave workloads.
- For every Allow statement covering a sensitive KMS action, add a Condition block that references one or more
kms:RecipientAttestation:*condition keys tied to the enclave measurement. - Reject or scope any statement that cannot be conditioned on attestation.
Source Code
Resource Type
AwsKmsKey