Check ID: objectstorage_container_metadata_sensitive_data
Provider: OpenStack
Service: objectstorage
Severity: CRITICAL
Categories: threat-detection, secrets, encryption
Resource type: OS::Swift::Container

​
What this check verifies

OpenStack Swift container metadata is evaluated to detect sensitive data such as passwords, API keys, secrets, and private keys. Container metadata is accessible to any user with read access to the container. Storing secrets in metadata exposes them to unauthorized access and credential theft.

​
Risk

Container metadata containing sensitive data exposes credentials to any user with container read access. Attackers with read permissions can extract passwords, API keys, and private keys. Stolen credentials enable unauthorized access to other systems, data exfiltration, and privilege escalation.

​
Recommendation

Never store secrets in container metadata. Use Barbican (OpenStack Key Manager), Vault, or external secrets management instead. Remove existing sensitive metadata and rotate any exposed credentials. Implement metadata policies to prevent future secret storage.

​
Remediation

swift post <container_name> —meta ‘<sensitive_key>:’

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_container_metadata_sensitive_data. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks