Check ID:
Provider: OpenStack
Service:
Severity: MEDIUM
Categories:
Resource type:
image_protected_status_enabledProvider: OpenStack
Service:
imageSeverity: MEDIUM
Categories:
resilienceResource type:
OS::Glance::WebImageWhat this check verifies
OpenStack images are evaluated to verify that the protected flag is set to True. Protected images cannot be deleted, preventing accidental or malicious removal of base images that dependent workloads rely on. Best practices recommend enabling deletion protection on all production images.Risk
Unprotected images can be accidentally or maliciously deleted, breaking all dependent instances and workloads. Image deletion is irreversible and can cause prolonged outages while replacement images are built and tested. In multi-tenant environments, unauthorized deletion of shared images can impact multiple projects.Recommendation
Enable deletion protection on all production images to prevent accidental or malicious removal. Implement image lifecycle management procedures that require explicit unprotection before decommissioning images.Remediation
- CLI
- Terraform
- Dashboard steps
openstack image set —protected <image_id>
References
- https://docs.openstack.org/security-guide/image-storage/checklist.html
- https://docs.openstack.org/glance/latest/admin/manage-images.html
Where this check fires
This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable byCheck ID = image_protected_status_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks