Check ID: compute_instance_trusted_image_certificates
Provider: OpenStack
Service: compute
Severity: HIGH
Categories: trust-boundaries, encryption
Resource type: OS::Nova::Server

​
What this check verifies

OpenStack compute instances (VMs) are evaluated to verify that trusted image certificates are configured. Trusted image certificates enable cryptographic validation of image signatures using Glance image signing (OpenStack Image Signature Verification). This ensures instances are launched from verified, untampered images signed by trusted authorities.

​
Risk

Instances without trusted certificates can be launched from tampered images containing backdoors, rootkits, or malware. Attackers can inject malicious code into unsigned images, and without signature verification, Nova launches compromised images. Malicious images enable persistence, lateral movement, data exfiltration, service disruption, and cryptomining.

​
Recommendation

Sign all images using GPG or X.509 certificates before uploading to Glance. Use Barbican to store signing certificates securely. Enforce trusted_image_certificates for production instances via policy. Enable signature verification in Nova (verify_glance_signatures=True). Restrict image upload permissions to authorized CI/CD pipelines. Implement certificate rotation every 12 months.

​
Remediation

# Terraform: launch instance with trusted image certificates

# Note: Requires Glance image with signature metadata and Barbican certificate

resource "openstack_compute_instance_v2" "instance" {
  name            = "secure-instance"
  image_id        = var.signed_image_id  # Must be signed image
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  security_groups = ["default"]

  # Specify trusted certificate IDs for signature validation
  # Note: This requires Nova microversion 2.63+ support
  trusted_image_certificates = [
    var.image_signing_cert_id,
    var.backup_cert_id
  ]

  network {
    name = var.network_name
  }
}

# Ensure image has signature metadata
data "openstack_images_image_v2" "signed_image" {
  name        = "ubuntu-22.04-signed"
  most_recent = true

  # Verify signature properties exist
  properties = {
    img_signature                   = "required"
    img_signature_hash_method       = "SHA-256"
    img_signature_key_type          = "RSA-PSS"
    img_signature_certificate_uuid  = "required"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_trusted_image_certificates. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks