Back to Checks
openstack

Object storage containers do not grant anonymous read access

objectstorage_container_public_read_acl_disabled
Service: objectstorageSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:OS::Swift::Container

OpenStack Swift containers are evaluated to verify that anonymous read access is not granted. The .r:* ACL allows any unauthenticated user on the internet to read objects in the container. This is a critical exposure that can lead to data leaks, especially when containers hold sensitive information such as backups, logs, or application data.

Prowler logoProwlerprowler-provider-openstack

Risk

Containers with .r:* in the read ACL are publicly accessible without authentication. Attackers can enumerate and download all objects, leading to data breaches, credential exposure, and compliance violations. Public containers are frequently targeted by automated scanners.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks objectstorage_container_public_read_acl_disabled

Recommendation

Remove .r:* from container read ACLs to prevent anonymous access. Use project-scoped ACLs (e.g., project-id:*) or specific user ACLs instead. If public access is required, consider using a CDN or signed URLs with time-limited tokens.

Remediation

CLI

swift post <container_name> --read-acl ''

Other

1Navigate to **Object Store > Containers**
2Select the container with public read ACL
3Edit the container metadata
4Remove the `.r:*` entry from the Read ACL
5Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_container_public_read_acl_disabled(Check):
    """Ensure object storage containers do not grant anonymous read access."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for container in objectstorage_client.containers:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=container)
            acl_entries = [entry.strip() for entry in container.read_ACL.split(",")]
            if ".r:*" in acl_entries:
                report.status = "FAIL"
                report.status_extended = f"Container {container.name} has public read ACL (.r:*) allowing anonymous access."
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Container {container.name} does not have public read ACL."
                )

            findings.append(report)

        return findings

References