Compute instances use trusted image certificates
OpenStack compute instances (VMs) are evaluated to verify that trusted image certificates are configured. Trusted image certificates enable cryptographic validation of image signatures using Glance image signing (OpenStack Image Signature Verification). This ensures instances are launched from verified, untampered images signed by trusted authorities.
ProwlerRisk
Instances without trusted certificates can be launched from tampered images containing backdoors, rootkits, or malware. Attackers can inject malicious code into unsigned images, and without signature verification, Nova launches compromised images. Malicious images enable persistence, lateral movement, data exfiltration, service disruption, and cryptomining.
Run this check with Prowler
Run in Prowler Cloudprowler openstack --checks compute_instance_trusted_image_certificatesRecommendation
Sign all images using GPG or X.509 certificates before uploading to Glance. Use Barbican to store signing certificates securely. Enforce trusted_image_certificates for production instances via policy. Enable signature verification in Nova (verify_glance_signatures=True). Restrict image upload permissions to authorized CI/CD pipelines. Implement certificate rotation every 12 months.
Remediation
Terraform
# Terraform: launch instance with trusted image certificates
# Note: Requires Glance image with signature metadata and Barbican certificate
resource "openstack_compute_instance_v2" "instance" {
name = "secure-instance"
image_id = var.signed_image_id # Must be signed image
flavor_id = var.flavor_id
key_pair = var.key_pair_name
security_groups = ["default"]
# Specify trusted certificate IDs for signature validation
# Note: This requires Nova microversion 2.63+ support
trusted_image_certificates = [
var.image_signing_cert_id,
var.backup_cert_id
]
network {
name = var.network_name
}
}
# Ensure image has signature metadata
data "openstack_images_image_v2" "signed_image" {
name = "ubuntu-22.04-signed"
most_recent = true
# Verify signature properties exist
properties = {
img_signature = "required"
img_signature_hash_method = "SHA-256"
img_signature_key_type = "RSA-PSS"
img_signature_certificate_uuid = "required"
}
}Other
Check Code
from typing import List
from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.compute.compute_client import compute_client
class compute_instance_trusted_image_certificates(Check):
"""Ensure compute instances use trusted image certificates for image signature validation."""
def execute(self) -> List[CheckReportOpenStack]:
findings: List[CheckReportOpenStack] = []
for instance in compute_client.instances:
report = CheckReportOpenStack(metadata=self.metadata(), resource=instance)
if instance.trusted_image_certificates:
report.status = "PASS"
cert_ids = ", ".join(instance.trusted_image_certificates)
report.status_extended = f"Instance {instance.name} ({instance.id}) uses trusted image certificates: {cert_ids}."
else:
report.status = "FAIL"
report.status_extended = f"Instance {instance.name} ({instance.id}) does not use trusted image certificates (image signature validation not enforced)."
findings.append(report)
return findings