Back to Checks
openstack

Images have hardware memory encryption enabled

image_hw_mem_encryption_enabled
Service: imageSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:OS::Glance::WebImage

OpenStack images are evaluated to verify that the hw_mem_encryption property is set to True. Hardware memory encryption (AMD SEV) protects guest memory from host-level attacks by encrypting it with a per-VM key managed by the CPU. Best practices recommend enabling memory encryption for workloads processing sensitive data in shared infrastructure.

Prowler logoProwlerprowler-provider-openstack

Risk

Images without memory encryption enabled may expose guest memory to host-level attacks, hypervisor vulnerabilities, or malicious co-tenants. In shared infrastructure, an attacker with hypervisor access could read sensitive data from unencrypted guest memory, including cryptographic keys, credentials, and application data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks image_hw_mem_encryption_enabled

Recommendation

Enable hardware memory encryption on images processing sensitive data. Ensure compute hosts support AMD SEV or equivalent technology. Create dedicated SEV-enabled flavors and host aggregates. Test workload compatibility with memory encryption before production deployment.

Remediation

CLI

openstack image set --property hw_mem_encryption=True <image_id>

Terraform

resource "openstack_images_image_v2" "image" {
  name             = "secure-image"
  container_format = "bare"
  disk_format      = "qcow2"
  visibility       = "private"

  properties = {
    hw_mem_encryption = "true"  # GOOD: Memory encryption enabled
  }
}

Other

1*Enable memory encryption:**
2Verify compute hosts support AMD SEV
3Set image property: `openstack image set --property hw_mem_encryption=True <image_id>`
4Ensure a flavor with SEV support is available
5Boot instances using the encrypted image with an SEV-enabled flavor

Check Code

"""OpenStack Image Memory Encryption Check."""

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.image.image_client import image_client


class image_hw_mem_encryption_enabled(Check):
    """Ensure images have hardware memory encryption enabled."""

    def execute(self) -> List[CheckReportOpenStack]:
        """Execute image_hw_mem_encryption_enabled check.

        Iterates over all images and verifies that the hw_mem_encryption
        property is set to True, enabling AMD SEV guest memory encryption.

        Returns:
            list[CheckReportOpenStack]: List of findings for each image.
        """
        findings: List[CheckReportOpenStack] = []

        for image in image_client.images:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=image)

            if image.hw_mem_encryption is True:
                report.status = "PASS"
                report.status_extended = f"Image {image.name} ({image.id}) has hardware memory encryption enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"Image {image.name} ({image.id}) does not have hardware memory encryption enabled."

            findings.append(report)

        return findings

References