Back to Checks
openstack

Object storage container read ACL is not globally shared

objectstorage_container_acl_not_globally_shared
Service: objectstorageSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:OS::Swift::Container

OpenStack Swift containers are evaluated to verify that the read ACL does not use *:* (global sharing). The *:* ACL grants read access to all authenticated users from any project in the OpenStack deployment, violating project isolation and the principle of least privilege.

Prowler logoProwlerprowler-provider-openstack

Risk

Containers with *:* read ACL are accessible to every authenticated user in the OpenStack deployment, regardless of their project. This breaks multi-tenant isolation, exposing data to users in other projects. Compromised credentials from any project can access the container's contents.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks objectstorage_container_acl_not_globally_shared

Recommendation

Replace *:* read ACLs with project-scoped ACLs (e.g., project-id:* or project-id:user-id). Use the most restrictive ACL that meets access requirements. Implement regular ACL audits to detect overly permissive configurations. Consider using Keystone role-based access control for fine-grained permissions.

Remediation

CLI

swift post <container_name> --read-acl '<project_id>:*'

Other

1Navigate to **Object Store > Containers**
2Select the container with global read ACL
3Edit the container metadata
4Replace `*:*` with specific project-scoped ACLs
5Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_container_acl_not_globally_shared(Check):
    """Ensure object storage container read ACL does not use global sharing."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for container in objectstorage_client.containers:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=container)
            acl_entries = [entry.strip() for entry in container.read_ACL.split(",")]
            if "*:*" in acl_entries or "*" in acl_entries:
                report.status = "FAIL"
                report.status_extended = f"Container {container.name} has globally shared read ACL (*:*) allowing all authenticated users from any project."
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Container {container.name} read ACL is not globally shared."
                )

            findings.append(report)

        return findings

References