No enclave with an unknown image identity has called this KMS key
kms_key_enclave_attestation_unknown_image
Scans CloudTrail attestation activity and flags PCR values missing from enclave_golden_pcr_values (only for buckets with a configured golden list). Complements kms_key_enclave_attestation_pcr_mismatch by catching real enclave calls with an unrecognized image. MEDIUM by default, overridable to HIGH via enclave_unknown_image_severity.
Risk
An attestation event whose PCRs cannot be traced back to a known-good enclave build indicates either a stale golden list, a policy broad enough to accept unaudited images, or a compromise scenario in which an unknown image is being executed with legitimate KMS access. Materiality depends on the operator's threat model.
prowler aws --checks kms_key_enclave_attestation_unknown_image
Recommendation
Treat the enclave_golden_pcr_values list as a live registry of trusted enclave images. Any runtime attestation from a PCR outside that list is either a documentation gap (extend the list) or a suspected incident (investigate).
Remediation
- Configure the Prowler
audit_configwith your golden PCR list, e.g.enclave_golden_pcr_values: {PCR0: [<trusted-pcr0-hash-from-ci>], PCR8: [<trusted-signing-cert-hash>]}. Optionally setenclave_unknown_image_severity: highto escalate findings. - Compare the flagged PCR values against your enclave CI/CD build catalogue. If they map to a legitimate build that is missing from
enclave_golden_pcr_values, extend the list. - If the PCR values do NOT map to any legitimate build, treat as a suspected incident: identify the enclave via CloudTrail's
attestationDocumentModuleId, terminate it, and audit the launch pipeline. - Consider tightening the KMS key policy so only golden PCRs are accepted (paired with
kms_key_enclave_attestation_pcr_mismatch).
Source Code
Resource Type
AwsKmsKey
References
Related To
- kms_key_enclave_attestation_pcr_mismatch
- kms_key_enclave_debug_attestation_detected