Check ID:
Provider: OpenStack
Service:
Severity: HIGH
Categories:
Resource type:
image_not_publicly_visibleProvider: OpenStack
Service:
imageSeverity: HIGH
Categories:
trust-boundariesResource type:
OS::Glance::WebImageWhat this check verifies
OpenStack images are evaluated to verify that visibility is not set to ‘public’. Public images are accessible to all tenants in the cloud, potentially exposing operating system configurations, embedded credentials, proprietary software, and security hardening details. Best practices recommend keeping images private or shared only with specific trusted projects.Risk
Public images expose operating system configurations, embedded credentials, and proprietary software to all tenants. Attackers can analyze public images to discover vulnerabilities, extract secrets, or clone them for malicious purposes. Public images may also violate compliance requirements for data isolation between tenants.Recommendation
Set image visibility to ‘private’ or ‘shared’ with specific trusted projects. Regularly audit image visibility settings. Implement policies to prevent creation of public images in production environments.Remediation
- CLI
- Terraform
- Dashboard steps
openstack image set —private <image_id>
References
- https://docs.openstack.org/security-guide/image-storage/checklist.html
- https://docs.openstack.org/glance/latest/admin/manage-images.html
Where this check fires
This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable byCheck ID = image_not_publicly_visible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks