Back to Checks
openstack

Images have Secure Boot set to required

image_secure_boot_enabled
Service: imageSeverity: medium
OfficialBuilt-inVerified
Categories:encryptiontrust-boundaries
Resource Type:OS::Glance::WebImage

OpenStack images are evaluated to verify that the os_secure_boot property is set to 'required'. Secure Boot ensures that only signed and trusted bootloaders and firmware execute during the boot process, protecting against bootkits, rootkits, and firmware-level attacks. Best practices recommend requiring Secure Boot for all production workloads.

Prowler logoProwlerprowler-provider-openstack

Risk

Images without Secure Boot allow unauthorized bootloader and firmware modifications. Attackers can install bootkits or rootkits that persist across reboots and are invisible to operating system security tools. Without Secure Boot, compromised firmware can intercept all system operations including encryption key management.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks image_secure_boot_enabled

Recommendation

Set os_secure_boot to 'required' on all production images. Ensure images use UEFI firmware type (hw_firmware_type=uefi). Test Secure Boot compatibility before enabling in production. Use signed bootloaders and kernel images.

Remediation

CLI

openstack image set --property os_secure_boot=required <image_id>

Terraform

resource "openstack_images_image_v2" "image" {
  name             = "secure-image"
  container_format = "bare"
  disk_format      = "qcow2"
  visibility       = "private"

  properties = {
    os_secure_boot   = "required"  # GOOD: Secure Boot required
    hw_firmware_type = "uefi"      # Required for Secure Boot
  }
}

Other

1*Enable Secure Boot:**
2Verify the image supports UEFI boot mode
3Set the Secure Boot property: `openstack image set --property os_secure_boot=required <image_id>`
4Ensure the image also has `hw_firmware_type=uefi` set
5Use a compatible flavor and verify boot succeeds

Check Code

"""OpenStack Image Secure Boot Check."""

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.image.image_client import image_client


class image_secure_boot_enabled(Check):
    """Ensure images have Secure Boot set to required."""

    def execute(self) -> List[CheckReportOpenStack]:
        """Execute image_secure_boot_enabled check.

        Iterates over all images and verifies that the os_secure_boot
        property is set to 'required', ensuring only signed bootloaders
        and firmware can execute.

        Returns:
            list[CheckReportOpenStack]: List of findings for each image.
        """
        findings: List[CheckReportOpenStack] = []

        for image in image_client.images:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=image)

            if image.os_secure_boot == "required":
                report.status = "PASS"
                report.status_extended = (
                    f"Image {image.name} ({image.id}) has Secure Boot set to required."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Image {image.name} ({image.id}) does not have Secure Boot "
                    f"set to required (os_secure_boot={image.os_secure_boot})."
                )

            findings.append(report)

        return findings

References