Back to Checks
openstack

Compute instances have locked status enabled

compute_instance_locked_status_enabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:OS::Nova::Server

OpenStack compute instances (VMs) are evaluated to verify that locked status is enabled. Locking an instance prevents unauthorized administrative operations (delete, resize, rebuild, etc.) without first unlocking it. This provides an additional layer of protection against accidental or malicious modifications.

Prowler logoProwlerprowler-provider-openstack

Risk

Instances without locked status can be subjected to unauthorized operations (deletion, resize, rebuild) by compromised accounts without additional barriers. Attackers can manipulate unlocked instances to destroy forensic evidence or disrupt production workloads. Accidental termination by operators also poses risk due to lack of change control barriers.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks compute_instance_locked_status_enabled

Recommendation

Lock production instances to prevent accidental or unauthorized modifications. Use --reason parameter to document lock purpose. Implement approval workflows requiring consent before unlocking. Apply locks to critical infrastructure (databases, authentication, logging). Use RBAC policies to restrict who can lock/unlock. Audit lock/unlock operations via OpenStack logs.

Remediation

CLI

openstack server lock <instance_id> --reason "Production instance - requires approval"
openstack server show <instance_id>

Terraform

# Note: Terraform openstack_compute_instance_v2 does not support locked status natively
# Use null_resource with local-exec provisioner as workaround

resource "openstack_compute_instance_v2" "instance" {
  name            = "production-instance"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  security_groups = ["default"]

  network {
    name = var.network_name
  }
}

resource "null_resource" "lock_instance" {
  depends_on = [openstack_compute_instance_v2.instance]

  provisioner "local-exec" {
    command = "openstack server lock ${openstack_compute_instance_v2.instance.id}"
  }
}

Other

1Navigate to **Compute > Instances**
2Select the instance to protect
3Use CLI or API to lock the instance
4Verify locked status is enabled

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.compute.compute_client import compute_client


class compute_instance_locked_status_enabled(Check):
    """Ensure compute instances have locked status enabled to prevent unauthorized operations."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for instance in compute_client.instances:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=instance)
            if instance.is_locked:
                report.status = "PASS"
                reason = (
                    f" (reason: {instance.locked_reason})"
                    if instance.locked_reason
                    else ""
                )
                report.status_extended = f"Instance {instance.name} ({instance.id}) has locked status enabled{reason}."
            else:
                report.status = "FAIL"
                report.status_extended = f"Instance {instance.name} ({instance.id}) does not have locked status enabled."

            findings.append(report)

        return findings

References