Check ID: blockstorage_volume_not_unattached
Provider: OpenStack
Service: blockstorage
Severity: LOW
Categories: trust-boundaries
Resource type: OS::Cinder::Volume

​
What this check verifies

OpenStack block storage volumes are evaluated to verify they are attached to at least one instance. Unattached volumes may indicate orphaned resources that are no longer in use but continue to incur storage costs and may contain sensitive data without active monitoring or access controls.

​
Risk

Unattached volumes may contain sensitive data that is no longer actively managed or monitored. Orphaned volumes increase storage costs and can be overlooked during security audits. If unattached volumes contain credentials or sensitive data, they may be accessed by unauthorized users who gain project access.

​
Recommendation

Review unattached volumes regularly and delete those no longer needed. Back up important data before deletion. Implement volume lifecycle policies and automated cleanup for orphaned resources. Tag volumes with ownership and purpose metadata for easier management.

​
Remediation

openstack volume list —status available openstack volume delete <volume_id>

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = blockstorage_volume_not_unattached. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks