Check ID: objectstorage_container_sync_not_enabled
Provider: OpenStack
Service: objectstorage
Severity: MEDIUM
Categories: trust-boundaries
Resource type: OS::Swift::Container

​
What this check verifies

OpenStack Swift containers are evaluated to verify that container sync is not configured. Container sync replicates objects to another Swift cluster, potentially outside the organization’s control. Unauthorized sync configurations can be used for data exfiltration to external clusters.

​
Risk

Container sync replicates all objects to a remote Swift cluster. If misconfigured or set up by an attacker, sensitive data is continuously exfiltrated to an external location. The sync operates automatically and silently, making it difficult to detect ongoing data theft.

​
Recommendation

Disable container sync unless explicitly required for disaster recovery. If sync is needed, ensure the target cluster is within your organization’s trust boundary. Monitor sync configurations for unauthorized changes. Implement RBAC policies to restrict who can configure container sync.

​
Remediation

swift post <container_name> -H ‘X-Container-Sync-To:’ -H ‘X-Container-Sync-Key:’

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_container_sync_not_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks