Images have hardware memory encryption enabled

Check ID: image_hw_mem_encryption_enabled
Provider: OpenStack
Service: image
Severity: MEDIUM
Categories: encryption
Resource type: OS::Glance::WebImage

What this check verifies

OpenStack images are evaluated to verify that the hw_mem_encryption property is set to True. Hardware memory encryption (AMD SEV) protects guest memory from host-level attacks by encrypting it with a per-VM key managed by the CPU. Best practices recommend enabling memory encryption for workloads processing sensitive data in shared infrastructure.

Risk

Images without memory encryption enabled may expose guest memory to host-level attacks, hypervisor vulnerabilities, or malicious co-tenants. In shared infrastructure, an attacker with hypervisor access could read sensitive data from unencrypted guest memory, including cryptographic keys, credentials, and application data.

Remediation

CLI
Terraform
Dashboard steps

openstack image set --property hw_mem_encryption=True <image_id>

resource "openstack_images_image_v2" "image" {
  name             = "secure-image"
  container_format = "bare"
  disk_format      = "qcow2"
  visibility       = "private"

  properties = {
    hw_mem_encryption = "true"  # GOOD: Memory encryption enabled
  }
}

Enable memory encryption:

Verify compute hosts support AMD SEV
Set image property: openstack image set --property hw_mem_encryption=True <image_id>
Ensure a flavor with SEV support is available
Boot instances using the encrypted image with an SEV-enabled flavor

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = image_hw_mem_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

Images have hardware memory encryption enabled

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires