Back to Checks
openstack

Compute instances have security groups attached

compute_instance_security_groups_attached
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:OS::Nova::Server

OpenStack compute instances (VMs) are evaluated to verify that at least one security group is attached. Security groups act as virtual firewalls, controlling ingress and egress traffic. Instances without security groups may have unrestricted network access, violating defense-in-depth principles.

Prowler logoProwlerprowler-provider-openstack

Risk

Instances without security groups are exposed to unrestricted network traffic from any source. Attackers can probe open ports, exploit vulnerable services, conduct injection attacks, and tamper with data without firewall barriers. Lack of network access controls enables unauthorized access, data exfiltration, lateral movement, DDoS attacks, and resource exhaustion.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks compute_instance_security_groups_attached

Recommendation

Attach security groups to all instances following least privilege principle: allow only required ports and sources, deny all by default. Use separate security groups per tier (web, app, database) with explicit rules. Avoid overly permissive rules like 0.0.0.0/0 ingress on sensitive ports. Implement network segmentation with isolated networks. Regularly audit and remove stale rules.

Remediation

CLI

openstack server add security group <instance_id> <security_group_name>

Terraform

# Terraform: ensure compute instance has security groups attached
resource "openstack_compute_instance_v2" "instance" {
  name            = "example-instance"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  # Critical: attach at least one security group
  security_groups = ["default", "web-sg", "app-sg"]

  network {
    name = var.network_name
  }
}

Other

1Navigate to **Compute > Instances**
2Select instance without security groups
3Click **Actions > Edit Security Groups**
4Add at least one security group
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.compute.compute_client import compute_client


class compute_instance_security_groups_attached(Check):
    """Ensure compute instances have security groups attached."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for instance in compute_client.instances:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=instance)
            if instance.security_groups:
                report.status = "PASS"
                sg_names = ", ".join(instance.security_groups)
                report.status_extended = f"Instance {instance.name} ({instance.id}) has security groups attached: {sg_names}."
            else:
                report.status = "FAIL"
                report.status_extended = f"Instance {instance.name} ({instance.id}) does not have any security groups attached."

            findings.append(report)

        return findings

References