Block storage volume metadata has no sensitive data

Check ID: blockstorage_volume_metadata_sensitive_data
Provider: OpenStack
Service: blockstorage
Severity: CRITICAL
Categories: secrets, encryption
Resource type: OS::Cinder::Volume

What this check verifies

OpenStack block storage volume metadata is evaluated to detect sensitive data such as passwords, API keys, secrets, and private keys. Volume metadata is accessible via the OpenStack API to any user with access to the project. Storing secrets in metadata exposes them to unauthorized access through the API.

Risk

Volume metadata containing sensitive data exposes credentials through the OpenStack API, accessible to any project member. Attackers with project access can enumerate volume metadata to extract passwords, API keys, and private keys. Stolen credentials enable unauthorized modifications, privilege escalation, and data breaches.

Recommendation

Never store secrets in volume metadata; use Barbican (OpenStack Key Manager), Vault, or external secrets management instead. Remove any sensitive data currently stored in volume metadata and rotate exposed credentials immediately. Implement metadata policies to prevent sensitive data from being added.

Remediation

CLI
Terraform
Dashboard steps

openstack volume unset —property <sensitive_key> <volume_id>

# Use Barbican for secrets instead of volume metadata
resource "openstack_blockstorage_volume_v3" "secure_volume" {
  name = "app-data"
  size = 10

  # Safe metadata (non-sensitive labels only)
  metadata = {
    environment = "production"
    application = "web-app"
  }
}

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = blockstorage_volume_metadata_sensitive_data. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires