Check ID: blockstorage_snapshot_not_orphaned
Provider: OpenStack
Service: blockstorage
Severity: LOW
Categories: trust-boundaries
Resource type: OS::Cinder::Snapshot

​
What this check verifies

OpenStack block storage snapshots are evaluated to verify they reference existing volumes. Orphaned snapshots (whose source volumes have been deleted) may contain stale data, incur unnecessary storage costs, and can be overlooked during security reviews. They may also contain sensitive data from deleted volumes that is no longer being managed.

​
Risk

Orphaned snapshots may contain sensitive data from deleted volumes that is no longer actively managed or monitored. These snapshots continue to consume storage resources and may be restored by unauthorized users to access old data. They can be overlooked during security audits and compliance reviews.

​
Recommendation

Review orphaned snapshots regularly and delete those no longer needed. Before deleting a volume, review and clean up associated snapshots. Implement snapshot lifecycle policies to prevent accumulation of orphaned snapshots. Tag snapshots with ownership and purpose metadata.

​
Remediation

openstack volume snapshot list openstack volume snapshot delete <snapshot_id>

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = blockstorage_snapshot_not_orphaned. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks