Compute instances have config drive enabled

Check ID: compute_instance_config_drive_enabled
Provider: OpenStack
Service: compute
Severity: LOW
Categories: trust-boundaries
Resource type: OS::Nova::Server

What this check verifies

OpenStack compute instances (VMs) are evaluated to verify that config drive is enabled. Config drive provides metadata and user data via a virtual CD-ROM device instead of the metadata service (169.254.169.254). This improves security by eliminating network-based metadata access, which can be vulnerable to SSRF attacks and metadata service exploitation.

Risk

Instances without config drive rely on the metadata service (169.254.169.254), vulnerable to SSRF attacks that extract credentials and SSH keys. Metadata service is vulnerable to spoofing in compromised networks and can become unavailable. Config drive eliminates this attack surface by providing metadata via virtual CD-ROM, removing dependency on network-accessible metadata.

Recommendation

Enable config drive on all instances to eliminate metadata service attack surface. Config drive provides metadata via virtual CD-ROM instead of network-accessible service (169.254.169.254), preventing SSRF attacks. Combine with firewall rules blocking metadata service access from applications. Use config drive in air-gapped environments where metadata service is unavailable.

Remediation

CLI
Terraform
Dashboard steps

openstack server show <instance_id> -c config_drive openstack server image create <instance_id> —name backup-snapshot openstack server rebuild <instance_id> —image <image_id> —config-drive true

# Terraform: enable config drive for compute instance
resource "openstack_compute_instance_v2" "instance" {
  name            = "secure-instance"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  security_groups = ["default"]
  # Enable config drive for secure metadata injection
  config_drive    = true

  network {
    name = var.network_name
  }

  # Optional: cloud-init will automatically use config drive if available
  user_data = <<-EOF
    #cloud-config
    datasource_list: [ConfigDrive, OpenStack]
  EOF
}

References

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_config_drive_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to OpenStack checks

Block storage volumes are attached to instances Compute instances are isolated in private networks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires