Back to Checks
openstack

Block storage volumes do not have multi-attach enabled

blockstorage_volume_multiattach_disabled
Service: blockstorageSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:OS::Cinder::Volume

OpenStack block storage volumes are evaluated to verify that multi-attach is not enabled. Multi-attach allows a volume to be attached to multiple instances simultaneously, increasing the attack surface and potentially leading to data corruption or unauthorized access from compromised instances.

Prowler logoProwlerprowler-provider-openstack

Risk

Multi-attach volumes can be accessed by multiple instances simultaneously, increasing the blast radius if any attached instance is compromised. Data corruption may occur if applications do not implement proper cluster-aware file systems. Unauthorized modifications from one instance can affect all other attached instances.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks blockstorage_volume_multiattach_disabled

Recommendation

Disable multi-attach on volumes unless specifically required for clustered applications. When multi-attach is necessary, ensure cluster-aware file systems are used and implement strict access controls. Review multi-attach volumes regularly to verify continued business justification.

Remediation

CLI

openstack volume create --size 10 --type <non_multiattach_type> <volume_name>

Terraform

resource "openstack_blockstorage_volume_v3" "single_attach" {
  name        = "single-attach-volume"
  size        = 10
  multiattach = false
}

Other

1Identify volumes with multi-attach enabled
2Evaluate if multi-attach is truly required for the workload
3For volumes that do not require multi-attach, migrate data to a new volume without multi-attach
4Ensure multi-attach volumes use cluster-aware file systems (e.g., GFS2, OCFS2)

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.blockstorage.blockstorage_client import (
    blockstorage_client,
)


class blockstorage_volume_multiattach_disabled(Check):
    """Ensure block storage volumes do not have multi-attach enabled."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for volume in blockstorage_client.volumes:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=volume)
            if not volume.is_multiattach:
                report.status = "PASS"
                report.status_extended = f"Volume {volume.name} ({volume.id}) does not have multi-attach enabled."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Volume {volume.name} ({volume.id}) has multi-attach enabled, "
                    f"allowing simultaneous attachment to multiple instances."
                )

            findings.append(report)

        return findings

References