Back to Checks
openstack

Object storage containers do not have container sync enabled

objectstorage_container_sync_not_enabled
Service: objectstorageSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:OS::Swift::Container

OpenStack Swift containers are evaluated to verify that container sync is not configured. Container sync replicates objects to another Swift cluster, potentially outside the organization's control. Unauthorized sync configurations can be used for data exfiltration to external clusters.

Prowler logoProwlerprowler-provider-openstack

Risk

Container sync replicates all objects to a remote Swift cluster. If misconfigured or set up by an attacker, sensitive data is continuously exfiltrated to an external location. The sync operates automatically and silently, making it difficult to detect ongoing data theft.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks objectstorage_container_sync_not_enabled

Recommendation

Disable container sync unless explicitly required for disaster recovery. If sync is needed, ensure the target cluster is within your organization's trust boundary. Monitor sync configurations for unauthorized changes. Implement RBAC policies to restrict who can configure container sync.

Remediation

CLI

swift post <container_name> -H 'X-Container-Sync-To:' -H 'X-Container-Sync-Key:'

Other

1Identify containers with sync enabled
2Remove sync configuration using CLI
3Verify sync is disabled: `swift stat <container_name>`
4Review sync logs for unauthorized data transfers
5Investigate who configured the sync and when

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_container_sync_not_enabled(Check):
    """Ensure object storage containers do not have container sync configured."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for container in objectstorage_client.containers:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=container)
            if container.sync_to:
                report.status = "FAIL"
                report.status_extended = f"Container {container.name} has container sync enabled (sync target: {container.sync_to})."
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Container {container.name} does not have container sync enabled."
                )

            findings.append(report)

        return findings

References