Back to Checks
openstack

Block storage volumes have encryption enabled

blockstorage_volume_encryption_enabled
Service: blockstorageSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:OS::Cinder::Volume

OpenStack block storage volumes (Cinder) are evaluated to verify that encryption is enabled. Volume encryption protects data at rest by encrypting the entire volume using a key managed by the OpenStack Key Manager (Barbican). Without encryption, data stored on volumes is vulnerable to unauthorized access if the underlying storage is compromised.

Prowler logoProwlerprowler-provider-openstack

Risk

Unencrypted volumes expose data at rest to unauthorized access if physical storage media is compromised, stolen, or improperly decommissioned. Attackers with access to the storage backend can read sensitive data directly. Compliance frameworks (PCI-DSS, HIPAA, SOC2) require encryption of data at rest.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks blockstorage_volume_encryption_enabled

Recommendation

Enable encryption on all block storage volumes using encrypted volume types backed by Barbican key management. Create encrypted volume types with strong ciphers (aes-xts-plain64) and adequate key sizes (256-bit). Migrate existing unencrypted volumes to encrypted ones.

Remediation

CLI

openstack volume type create --encryption-provider luks --encryption-cipher aes-xts-plain64 --encryption-key-size 256 --encryption-control-location front-end encrypted_type
openstack volume create --size 10 --type encrypted_type encrypted-volume

Terraform

resource "openstack_blockstorage_volume_v3" "encrypted_volume" {
  name        = "encrypted-volume"
  size        = 10
  volume_type = openstack_blockstorage_volume_type_v3.encrypted.name
}

Other

1Navigate to **Block Storage > Volumes**
2Create a new volume using an encrypted volume type
3Migrate data from unencrypted volumes to encrypted ones
4Delete the old unencrypted volumes
5Note: Existing volumes cannot be encrypted in-place; data must be migrated.

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.blockstorage.blockstorage_client import (
    blockstorage_client,
)


class blockstorage_volume_encryption_enabled(Check):
    """Ensure block storage volumes have encryption enabled."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for volume in blockstorage_client.volumes:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=volume)
            if volume.is_encrypted:
                report.status = "PASS"
                report.status_extended = (
                    f"Volume {volume.name} ({volume.id}) has encryption enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Volume {volume.name} ({volume.id}) does not have encryption enabled."

            findings.append(report)

        return findings

References