Back to Checks
openstack

Images have deletion protection enabled

image_protected_status_enabled
Service: imageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:OS::Glance::WebImage

OpenStack images are evaluated to verify that the protected flag is set to True. Protected images cannot be deleted, preventing accidental or malicious removal of base images that dependent workloads rely on. Best practices recommend enabling deletion protection on all production images.

Prowler logoProwlerprowler-provider-openstack

Risk

Unprotected images can be accidentally or maliciously deleted, breaking all dependent instances and workloads. Image deletion is irreversible and can cause prolonged outages while replacement images are built and tested. In multi-tenant environments, unauthorized deletion of shared images can impact multiple projects.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks image_protected_status_enabled

Recommendation

Enable deletion protection on all production images to prevent accidental or malicious removal. Implement image lifecycle management procedures that require explicit unprotection before decommissioning images.

Remediation

CLI

openstack image set --protected <image_id>

Terraform

resource "openstack_images_image_v2" "image" {
  name             = "app-image"
  container_format = "bare"
  disk_format      = "qcow2"
  visibility       = "private"
  protected        = true  # GOOD: Deletion protection enabled
}

Other

1*Enable protection via Horizon:**
2Navigate to **Project > Compute > Images**
3Select the unprotected image
4Click **Edit Image**
5Check the **Protected** checkbox
6Click **Update Image**

Check Code

"""OpenStack Image Protected Status Check."""

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.image.image_client import image_client


class image_protected_status_enabled(Check):
    """Ensure images have deletion protection enabled."""

    def execute(self) -> List[CheckReportOpenStack]:
        """Execute image_protected_status_enabled check.

        Iterates over all images and verifies that the protected flag is
        set to True, preventing accidental or malicious deletion.

        Returns:
            list[CheckReportOpenStack]: List of findings for each image.
        """
        findings: List[CheckReportOpenStack] = []

        for image in image_client.images:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=image)

            if image.protected:
                report.status = "PASS"
                report.status_extended = (
                    f"Image {image.name} ({image.id}) has deletion protection enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Image {image.name} ({image.id}) does not have deletion protection enabled."

            findings.append(report)

        return findings

References