implementing-aws-nitro-enclave-security

Implements AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration using PCR-based condition keys, and secure vsock communication channels. The practitioner builds enclave images, configures attestation-aware KMS policies, validates attestation documents against the AWS Nitro PKI root of trust, and establishes isolated computation pipelines for processing sensitive data such as PII, cryptographic keys, and healthcare records. Activates for requests involving Nitro Enclave setup, enclave attestation validation, confidential computing on AWS, or KMS enclave policy configuration.

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/xalgord/xalgorix --skill implementing-aws-nitro-enclave-security

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

View all from this repository

Implementing AWS Nitro Enclave Security

When to Use

Processing sensitive data (PII, PHI, financial records, cryptographic secrets) that must be isolated from EC2 instance operators and administrators

Building confidential computing pipelines where even root-level access on the parent instance cannot read enclave memory or state

Implementing cryptographic attestation workflows that tie KMS decryption rights to a specific, verified enclave image hash

Deploying multi-party computation environments where two or more enclaves authenticate each other via attestation before exchanging data

Hardening existing workloads that currently decrypt secrets on the parent instance by migrating decryption into an enclave boundary

Do not use when the workload does not handle sensitive data that requires hardware-level isolation, when the instance type does not support Nitro Enclaves (requires Nitro-based instances with at least 4 vCPUs), or when latency constraints make the vsock communication overhead unacceptable.

Common Misconfigurations & Verification

KMS policy without an attestation condition: if the key policy grants the parent's IAM role kms:Decrypt but omits kms:RecipientAttestation:ImageSha384 (or PCR0/PCR8), the parent instance can decrypt directly and the enclave boundary is pointless. Grep the policy for RecipientAttestation and prove a parent-side kms:Decrypt without a Recipient attestation document returns AccessDenied.

--debug-mode left in production: debug mode makes the enclave console readable and zeros out PCR0/PCR1/PCR2, so attestation conditions can never match a real measurement. Confirm nitro-cli describe-enclaves shows "Flags": "NONE" (not DEBUG_MODE).

Allocator under-provisioned: if /etc/nitro_enclaves/allocator.yaml memory_mib/cpu_count is below what run-enclave requests, launch fails with an opaque "resource not available". Verify the file and that nitro-enclaves-allocator.service is active after edits.

PCR0 pinned but rebuilt: PCR0 changes on every image rebuild, breaking the policy. For rotating builds, bind to PCR8 (signing cert) instead.

Incomplete attestation validation: failing to walk the to the root CA, or skipping nonce checks, allows forged/replayed documents.

Implementing AWS Nitro Enclave Security

When to Use

Processing sensitive data (PII, PHI, financial records, cryptographic secrets) that must be isolated from EC2 instance operators and administrators

Building confidential computing pipelines where even root-level access on the parent instance cannot read enclave memory or state

Implementing cryptographic attestation workflows that tie KMS decryption rights to a specific, verified enclave image hash

Deploying multi-party computation environments where two or more enclaves authenticate each other via attestation before exchanging data

Hardening existing workloads that currently decrypt secrets on the parent instance by migrating decryption into an enclave boundary

Common Misconfigurations & Verification

PCR0 pinned but rebuilt: PCR0 changes on every image rebuild, breaking the policy. For rotating builds, bind to PCR8 (signing cert) instead.

Incomplete attestation validation: failing to walk the to the root CA, or skipping nonce checks, allows forged/replayed documents.

import socket import json import boto3 VSOCK_CID = 3 # Parent CID VSOCK_PORT = 5000 def start_proxy(): sock = socket.socket(socket.AF_VSOCK, socket.SOCK_STREAM) sock.bind((VSOCK_CID, VSOCK_PORT)) sock.listen(5) kms_client = boto3.client('kms', region_name='us-east-1') while True: conn, addr = sock.accept() data = conn.recv(65536) request = json.loads(data.decode()) if request['action'] == 'decrypt': response = kms_client.decrypt( CiphertextBlob=bytes.fromhex(request['ciphertext']), Recipient={ 'KeyEncryptionAlgorithm': 'RSAES_OAEP_SHA_256', 'AttestationDocument': bytes.fromhex(request['attestation_doc']) } ) conn.sendall(json.dumps({ 'ciphertext_for_recipient': response['CiphertextForRecipient'].hex() }).encode()) conn.close()

import socket import json from cryptography.hazmat.primitives.asymmetric import rsa, padding from cryptography.hazmat.primitives import hashes, serialization PARENT_CID = 3 VSOCK_PORT = 5000 def get_attestation_document(public_key_der): """Request attestation document from NSM device.""" # Uses the aws-nitro-enclaves-nsm-api # NSM provides: module_id, digest (SHA384), timestamp, PCRs, # certificate (from Nitro PKI), cabundle, public_key, user_data, nonce import nsm_util nsm_fd = nsm_util.nsm_lib_init() attestation_doc = nsm_util.nsm_get_attestation_doc( nsm_fd, public_key=public_key_der, user_data=None, nonce=None ) return attestation_doc def decrypt_via_parent(ciphertext_hex): """Send decrypt request through vsock to parent proxy.""" private_key = rsa.generate_private_key( public_exponent=65537, key_size=2048 ) public_key_der = private_key.public_key().public_bytes( serialization.Encoding.DER, serialization.PublicFormat.SubjectPublicKeyInfo ) attestation_doc = get_attestation_document(public_key_der) sock = socket.socket(socket.AF_VSOCK, socket.SOCK_STREAM) sock.connect((PARENT_CID, VSOCK_PORT)) sock.sendall(json.dumps({ 'action': 'decrypt', 'ciphertext': ciphertext_hex, 'attestation_doc': attestation_doc.hex() }).encode()) response = json.loads(sock.recv(65536).decode()) sock.close() # KMS encrypted the plaintext to the enclave's public key # Only the enclave's private key can decrypt it ciphertext_for_recipient = bytes.fromhex( response['ciphertext_for_recipient'] ) plaintext = private_key.decrypt( ciphertext_for_recipient, padding.OAEP( mgf=padding.MGF1(algorithm=hashes.SHA256()), algorithm=hashes.SHA256(), label=None ) ) return plaintext

import cbor2 from cose import CoseMessage from cryptography import x509 from cryptography.x509.oid import NameOID def validate_attestation(attestation_bytes, expected_pcrs, expected_nonce=None): cose_msg = CoseMessage.decode(attestation_bytes) payload = cbor2.loads(cose_msg.payload) # Verify certificate chain cert = x509.load_der_x509_certificate(payload['certificate']) cabundle = [x509.load_der_x509_certificate(c) for c in payload['cabundle']] # Check root CA is AWS Nitro root = cabundle[-1] cn = root.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value assert cn == 'aws.nitro-enclaves', f'Unexpected root CA: {cn}' # Verify PCR measurements pcrs = payload['pcrs'] for idx, expected_value in expected_pcrs.items(): actual = pcrs.get(idx, b'').hex() assert actual == expected_value, f'PCR{idx} mismatch: {actual}' # Verify nonce freshness if expected_nonce: assert payload.get('nonce') == expected_nonce, 'Nonce mismatch' return payload

name	implementing-aws-nitro-enclave-security
description	Implements AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration using PCR-based condition keys, and secure vsock communication channels. The practitioner builds enclave images, configures attestation-aware KMS policies, validates attestation documents against the AWS Nitro PKI root of trust, and establishes isolated computation pipelines for processing sensitive data such as PII, cryptographic keys, and healthcare records. Activates for requests involving Nitro Enclave setup, enclave attestation validation, confidential computing on AWS, or KMS enclave policy configuration.
domain	cybersecurity
subdomain	cloud-security
tags	["AWS-Nitro-Enclaves","confidential-computing","attestation","KMS","enclave-isolation","vsock","PCR"]
version	1.0.0
author	mukul975
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

name	implementing-aws-nitro-enclave-security
description	Implements AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration using PCR-based condition keys, and secure vsock communication channels. The practitioner builds enclave images, configures attestation-aware KMS policies, validates attestation documents against the AWS Nitro PKI root of trust, and establishes isolated computation pipelines for processing sensitive data such as PII, cryptographic keys, and healthcare records. Activates for requests involving Nitro Enclave setup, enclave attestation validation, confidential computing on AWS, or KMS enclave policy configuration.
domain	cybersecurity
subdomain	cloud-security
tags	["AWS-Nitro-Enclaves","confidential-computing","attestation","KMS","enclave-isolation","vsock","PCR"]
version	1.0.0
author	mukul975
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Term	Definition
Nitro Enclave	An isolated virtual machine created by the Nitro Hypervisor on a Nitro-based EC2 instance with no persistent storage, no network access, and no interactive access, even from the parent instance's root user
Attestation Document	A CBOR-encoded, COSE-signed document generated by the Nitro Security Module containing PCR measurements, a certificate chain to the AWS Nitro root CA, and optional user-provided data
PCR (Platform Configuration Register)	SHA-384 hash measurements that uniquely identify an enclave's image (PCR0), kernel/bootstrap (PCR1), application (PCR2), IAM role (PCR4), instance ID (PCR3), and signing certificate (PCR8)
Vsock	A virtual socket providing the sole communication channel between a parent EC2 instance and its enclave, using CID (Context Identifier) and port addressing
EIF (Enclave Image File)	The packaged enclave image built by nitro-cli from a Docker image, containing the kernel, ramdisk, and application, producing PCR measurements at build time
Nitro Security Module (NSM)	A custom Linux device (`/dev/nsm`) inside the enclave that provides attestation document generation and hardware random number generation
COSE_Sign1	CBOR Object Signing and Encryption single-signer structure used to sign the attestation document with the NSM's private key
kms:RecipientAttestation	AWS KMS condition key prefix that enables key policies to enforce that decrypt/generate operations only succeed when a valid attestation document with matching PCR values is presented

implementing-aws-nitro-enclave-security

Install options

Review the source files