Check ID: objectstorage_container_public_read_acl_disabled
Provider: OpenStack
Service: objectstorage
Severity: HIGH
Categories: internet-exposed
Resource type: OS::Swift::Container

​
What this check verifies

OpenStack Swift containers are evaluated to verify that anonymous read access is not granted. The .r:* ACL allows any unauthenticated user on the internet to read objects in the container. This is a critical exposure that can lead to data leaks, especially when containers hold sensitive information such as backups, logs, or application data.

​
Risk

Containers with .r:* in the read ACL are publicly accessible without authentication. Attackers can enumerate and download all objects, leading to data breaches, credential exposure, and compliance violations. Public containers are frequently targeted by automated scanners.

​
Recommendation

Remove .r:* from container read ACLs to prevent anonymous access. Use project-scoped ACLs (e.g., project-id:*) or specific user ACLs instead. If public access is required, consider using a CDN or signed URLs with time-limited tokens.

​
Remediation

swift post <container_name> —read-acl ”

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_container_public_read_acl_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks