Check ID:
Provider: OpenStack
Service:
Severity: HIGH
Categories:
Resource type:
compute_instance_security_groups_attachedProvider: OpenStack
Service:
computeSeverity: HIGH
Categories:
internet-exposed, trust-boundariesResource type:
OS::Nova::ServerWhat this check verifies
OpenStack compute instances (VMs) are evaluated to verify that at least one security group is attached. Security groups act as virtual firewalls, controlling ingress and egress traffic. Instances without security groups may have unrestricted network access, violating defense-in-depth principles.Risk
Instances without security groups are exposed to unrestricted network traffic from any source. Attackers can probe open ports, exploit vulnerable services, conduct injection attacks, and tamper with data without firewall barriers. Lack of network access controls enables unauthorized access, data exfiltration, lateral movement, DDoS attacks, and resource exhaustion.Recommendation
Attach security groups to all instances following least privilege principle: allow only required ports and sources, deny all by default. Use separate security groups per tier (web, app, database) with explicit rules. Avoid overly permissive rules like 0.0.0.0/0 ingress on sensitive ports. Implement network segmentation with isolated networks. Regularly audit and remove stale rules.Remediation
- CLI
- Terraform
- Dashboard steps
openstack server add security group <instance_id> <security_group_name>
References
- https://docs.openstack.org/nova/latest/user/security-groups.html
- https://docs.openstack.org/security-guide/networking/architecture.html
Where this check fires
This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable byCheck ID = compute_instance_security_groups_attached. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks