Back to Checks
openstack

Images are not publicly visible to all tenants

image_not_publicly_visible
Service: imageSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:OS::Glance::WebImage

OpenStack images are evaluated to verify that visibility is not set to 'public'. Public images are accessible to all tenants in the cloud, potentially exposing operating system configurations, embedded credentials, proprietary software, and security hardening details. Best practices recommend keeping images private or shared only with specific trusted projects.

Prowler logoProwlerprowler-provider-openstack

Risk

Public images expose operating system configurations, embedded credentials, and proprietary software to all tenants. Attackers can analyze public images to discover vulnerabilities, extract secrets, or clone them for malicious purposes. Public images may also violate compliance requirements for data isolation between tenants.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks image_not_publicly_visible

Recommendation

Set image visibility to 'private' or 'shared' with specific trusted projects. Regularly audit image visibility settings. Implement policies to prevent creation of public images in production environments.

Remediation

CLI

openstack image set --private <image_id>

Terraform

resource "openstack_images_image_v2" "image" {
  name             = "app-image"
  container_format = "bare"
  disk_format      = "qcow2"
  visibility       = "private"  # GOOD: Not publicly visible
}

Other

1*Change visibility via Horizon:**
2Navigate to **Project > Compute > Images**
3Select the public image
4Click **Edit Image**
5Change Visibility to **Private**
6Click **Update Image**

Check Code

"""OpenStack Image Public Visibility Check."""

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.image.image_client import image_client


class image_not_publicly_visible(Check):
    """Ensure images are not publicly visible to all tenants."""

    def execute(self) -> List[CheckReportOpenStack]:
        """Execute image_not_publicly_visible check.

        Iterates over all images and verifies that visibility is not set to
        'public', which would expose the image to all tenants.

        Returns:
            list[CheckReportOpenStack]: List of findings for each image.
        """
        findings: List[CheckReportOpenStack] = []

        for image in image_client.images:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=image)

            if image.visibility == "public":
                report.status = "FAIL"
                report.status_extended = f"Image {image.name} ({image.id}) is publicly visible to all tenants."
            else:
                report.status = "PASS"
                report.status_extended = f"Image {image.name} ({image.id}) is not publicly visible (visibility={image.visibility})."

            findings.append(report)

        return findings

References