Check ID: blockstorage_snapshot_metadata_sensitive_data
Provider: OpenStack
Service: blockstorage
Severity: CRITICAL
Categories: secrets, encryption
Resource type: OS::Cinder::Snapshot

​
What this check verifies

OpenStack block storage snapshot metadata is evaluated to detect sensitive data such as passwords, API keys, secrets, and private keys. Snapshot metadata is accessible via the OpenStack API to any user with access to the project. Storing secrets in metadata exposes them to unauthorized access through the API.

​
Risk

Snapshot metadata containing sensitive data exposes credentials through the OpenStack API, accessible to any project member. Attackers with project access can enumerate snapshot metadata to extract passwords, API keys, and private keys. Stolen credentials enable unauthorized modifications, privilege escalation, and data breaches.

​
Recommendation

Never store secrets in snapshot metadata; use Barbican (OpenStack Key Manager), Vault, or external secrets management instead. Remove any sensitive data currently stored in snapshot metadata and rotate exposed credentials immediately. Implement metadata policies to prevent sensitive data from being added.

​
Remediation

openstack volume snapshot unset —property <sensitive_key> <snapshot_id>

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = blockstorage_snapshot_metadata_sensitive_data. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks