Check ID:
Provider: OpenStack
Service:
Severity: MEDIUM
Categories:
Resource type:
blockstorage_volume_multiattach_disabledProvider: OpenStack
Service:
blockstorageSeverity: MEDIUM
Categories:
trust-boundariesResource type:
OS::Cinder::VolumeWhat this check verifies
OpenStack block storage volumes are evaluated to verify that multi-attach is not enabled. Multi-attach allows a volume to be attached to multiple instances simultaneously, increasing the attack surface and potentially leading to data corruption or unauthorized access from compromised instances.Risk
Multi-attach volumes can be accessed by multiple instances simultaneously, increasing the blast radius if any attached instance is compromised. Data corruption may occur if applications do not implement proper cluster-aware file systems. Unauthorized modifications from one instance can affect all other attached instances.Recommendation
Disable multi-attach on volumes unless specifically required for clustered applications. When multi-attach is necessary, ensure cluster-aware file systems are used and implement strict access controls. Review multi-attach volumes regularly to verify continued business justification.Remediation
- CLI
- Terraform
- Dashboard steps
openstack volume create —size 10 —type <non_multiattach_type> <volume_name>
References
Where this check fires
This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable byCheck ID = blockstorage_volume_multiattach_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks