Images have Secure Boot set to required

Check ID: image_secure_boot_enabled
Provider: OpenStack
Service: image
Severity: MEDIUM
Categories: encryption, trust-boundaries
Resource type: OS::Glance::WebImage

What this check verifies

OpenStack images are evaluated to verify that the os_secure_boot property is set to ‘required’. Secure Boot ensures that only signed and trusted bootloaders and firmware execute during the boot process, protecting against bootkits, rootkits, and firmware-level attacks. Best practices recommend requiring Secure Boot for all production workloads.

Risk

Images without Secure Boot allow unauthorized bootloader and firmware modifications. Attackers can install bootkits or rootkits that persist across reboots and are invisible to operating system security tools. Without Secure Boot, compromised firmware can intercept all system operations including encryption key management.

Recommendation

Set os_secure_boot to ‘required’ on all production images. Ensure images use UEFI firmware type (hw_firmware_type=uefi). Test Secure Boot compatibility before enabling in production. Use signed bootloaders and kernel images.

Remediation

CLI
Terraform
Dashboard steps

openstack image set --property os_secure_boot=required <image_id>

resource "openstack_images_image_v2" "image" {
  name             = "secure-image"
  container_format = "bare"
  disk_format      = "qcow2"
  visibility       = "private"

  properties = {
    os_secure_boot   = "required"  # GOOD: Secure Boot required
    hw_firmware_type = "uefi"      # Required for Secure Boot
  }
}

Enable Secure Boot:

Verify the image supports UEFI boot mode
Set the Secure Boot property: openstack image set --property os_secure_boot=required <image_id>
Ensure the image also has hw_firmware_type=uefi set
Use a compatible flavor and verify boot succeeds

References

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = image_secure_boot_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to OpenStack checks

Images have deletion protection enabled Images have cryptographic signature verification enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires