Compute instances have locked status enabled

Check ID: compute_instance_locked_status_enabled
Provider: OpenStack
Service: compute
Severity: MEDIUM
Categories: resilience
Resource type: OS::Nova::Server

What this check verifies

OpenStack compute instances (VMs) are evaluated to verify that locked status is enabled. Locking an instance prevents unauthorized administrative operations (delete, resize, rebuild, etc.) without first unlocking it. This provides an additional layer of protection against accidental or malicious modifications.

Risk

Instances without locked status can be subjected to unauthorized operations (deletion, resize, rebuild) by compromised accounts without additional barriers. Attackers can manipulate unlocked instances to destroy forensic evidence or disrupt production workloads. Accidental termination by operators also poses risk due to lack of change control barriers.

Recommendation

Lock production instances to prevent accidental or unauthorized modifications. Use —reason parameter to document lock purpose. Implement approval workflows requiring consent before unlocking. Apply locks to critical infrastructure (databases, authentication, logging). Use RBAC policies to restrict who can lock/unlock. Audit lock/unlock operations via OpenStack logs.

Remediation

CLI
Terraform
Dashboard steps

openstack server lock <instance_id> —reason “Production instance - requires approval” openstack server show <instance_id>

# Note: Terraform openstack_compute_instance_v2 does not support locked status natively
# Use null_resource with local-exec provisioner as workaround

resource "openstack_compute_instance_v2" "instance" {
  name            = "production-instance"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  security_groups = ["default"]

  network {
    name = var.network_name
  }
}

resource "null_resource" "lock_instance" {
  depends_on = [openstack_compute_instance_v2.instance]

  provisioner "local-exec" {
    command = "openstack server lock ${openstack_compute_instance_v2.instance.id}"
  }
}

References

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_locked_status_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to OpenStack checks

Compute instances use SSH key-based authentication Compute instance metadata does not contain sensitive data

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires