Back to Checks
openstack

Compute instances have config drive enabled

compute_instance_config_drive_enabled
Service: computeSeverity: low
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:OS::Nova::Server

OpenStack compute instances (VMs) are evaluated to verify that config drive is enabled. Config drive provides metadata and user data via a virtual CD-ROM device instead of the metadata service (169.254.169.254). This improves security by eliminating network-based metadata access, which can be vulnerable to SSRF attacks and metadata service exploitation.

Prowler logoProwlerprowler-provider-openstack

Risk

Instances without config drive rely on the metadata service (169.254.169.254), vulnerable to SSRF attacks that extract credentials and SSH keys. Metadata service is vulnerable to spoofing in compromised networks and can become unavailable. Config drive eliminates this attack surface by providing metadata via virtual CD-ROM, removing dependency on network-accessible metadata.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks compute_instance_config_drive_enabled

Recommendation

Enable config drive on all instances to eliminate metadata service attack surface. Config drive provides metadata via virtual CD-ROM instead of network-accessible service (169.254.169.254), preventing SSRF attacks. Combine with firewall rules blocking metadata service access from applications. Use config drive in air-gapped environments where metadata service is unavailable.

Remediation

CLI

openstack server show <instance_id> -c config_drive
openstack server image create <instance_id> --name backup-snapshot
openstack server rebuild <instance_id> --image <image_id> --config-drive true

Terraform

# Terraform: enable config drive for compute instance
resource "openstack_compute_instance_v2" "instance" {
  name            = "secure-instance"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  security_groups = ["default"]
  # Enable config drive for secure metadata injection
  config_drive    = true

  network {
    name = var.network_name
  }

  # Optional: cloud-init will automatically use config drive if available
  user_data = <<-EOF
    #cloud-config
    datasource_list: [ConfigDrive, OpenStack]
  EOF
}

Other

1Navigate to **Compute > Instances > Launch Instance**
2In **Configuration** or **Advanced Options** tab, enable **Config Drive**
3Complete instance launch
4Note: Config drive cannot be added to existing instances without rebuild

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.compute.compute_client import compute_client


class compute_instance_config_drive_enabled(Check):
    """Ensure compute instances have config drive enabled for secure metadata injection."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for instance in compute_client.instances:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=instance)
            if instance.has_config_drive:
                report.status = "PASS"
                report.status_extended = f"Instance {instance.name} ({instance.id}) has config drive enabled for secure metadata injection."
            else:
                report.status = "FAIL"
                report.status_extended = f"Instance {instance.name} ({instance.id}) does not have config drive enabled (relies on metadata service)."

            findings.append(report)

        return findings

References