Check ID: objectstorage_container_write_acl_restricted
Provider: OpenStack
Service: objectstorage
Severity: CRITICAL
Categories: internet-exposed, identity-access
Resource type: OS::Swift::Container

​
What this check verifies

OpenStack Swift containers are evaluated to verify that write access is restricted. The *:* write ACL allows any authenticated user from any project to create, modify, or delete objects. The * write ACL similarly grants unrestricted write access. Both configurations violate the principle of least privilege.

​
Risk

Containers with unrestricted write ACLs allow any authenticated OpenStack user to upload, overwrite, or delete objects. This enables data tampering, malware injection, ransomware attacks (encrypting objects), and resource abuse (cryptomining payloads). Compromised credentials from any project can be used to modify data.

​
Recommendation

Restrict write ACLs to specific project and user combinations (e.g., project-id:user-id). Never use *:* or * as write ACLs. Implement RBAC policies to control write access. Regularly audit container ACLs to detect overly permissive configurations.

​
Remediation

swift post <container_name> —write-acl ‘<project_id>:<user_id>’

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_container_write_acl_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks