Check ID: objectstorage_container_acl_not_globally_shared
Provider: OpenStack
Service: objectstorage
Severity: HIGH
Categories: identity-access
Resource type: OS::Swift::Container

​
What this check verifies

OpenStack Swift containers are evaluated to verify that the read ACL does not use *:* (global sharing). The *:* ACL grants read access to all authenticated users from any project in the OpenStack deployment, violating project isolation and the principle of least privilege.

​
Risk

Containers with *:* read ACL are accessible to every authenticated user in the OpenStack deployment, regardless of their project. This breaks multi-tenant isolation, exposing data to users in other projects. Compromised credentials from any project can access the container’s contents.

​
Recommendation

Replace *:* read ACLs with project-scoped ACLs (e.g., project-id:* or project-id:user-id). Use the most restrictive ACL that meets access requirements. Implement regular ACL audits to detect overly permissive configurations. Consider using Keystone role-based access control for fine-grained permissions.

​
Remediation

swift post <container_name> —read-acl ‘<project_id>:*’

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_container_acl_not_globally_shared. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks