Check ID: blockstorage_volume_encryption_enabled
Provider: OpenStack
Service: blockstorage
Severity: HIGH
Categories: encryption
Resource type: OS::Cinder::Volume

​
What this check verifies

OpenStack block storage volumes (Cinder) are evaluated to verify that encryption is enabled. Volume encryption protects data at rest by encrypting the entire volume using a key managed by the OpenStack Key Manager (Barbican). Without encryption, data stored on volumes is vulnerable to unauthorized access if the underlying storage is compromised.

​
Risk

Unencrypted volumes expose data at rest to unauthorized access if physical storage media is compromised, stolen, or improperly decommissioned. Attackers with access to the storage backend can read sensitive data directly. Compliance frameworks (PCI-DSS, HIPAA, SOC2) require encryption of data at rest.

​
Recommendation

Enable encryption on all block storage volumes using encrypted volume types backed by Barbican key management. Create encrypted volume types with strong ciphers (aes-xts-plain64) and adequate key sizes (256-bit). Migrate existing unencrypted volumes to encrypted ones.

​
Remediation

openstack volume type create —encryption-provider luks —encryption-cipher aes-xts-plain64 —encryption-key-size 256 —encryption-control-location front-end encrypted_type openstack volume create —size 10 —type encrypted_type encrypted-volume

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = blockstorage_volume_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks