Back to Checks
openstack

Object storage container write ACL is restricted

objectstorage_container_write_acl_restricted
Service: objectstorageSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposedidentity-access
Resource Type:OS::Swift::Container

OpenStack Swift containers are evaluated to verify that write access is restricted. The *:* write ACL allows any authenticated user from any project to create, modify, or delete objects. The * write ACL similarly grants unrestricted write access. Both configurations violate the principle of least privilege.

Prowler logoProwlerprowler-provider-openstack

Risk

Containers with unrestricted write ACLs allow any authenticated OpenStack user to upload, overwrite, or delete objects. This enables data tampering, malware injection, ransomware attacks (encrypting objects), and resource abuse (cryptomining payloads). Compromised credentials from any project can be used to modify data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks objectstorage_container_write_acl_restricted

Recommendation

Restrict write ACLs to specific project and user combinations (e.g., project-id:user-id). Never use *:* or * as write ACLs. Implement RBAC policies to control write access. Regularly audit container ACLs to detect overly permissive configurations.

Remediation

CLI

swift post <container_name> --write-acl '<project_id>:<user_id>'

Other

1Navigate to **Object Store > Containers**
2Select the container with unrestricted write ACL
3Edit the container metadata
4Replace `*:*` or `*` with specific `project-id:user-id` entries
5Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_container_write_acl_restricted(Check):
    """Ensure object storage container write ACL does not allow all authenticated users."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for container in objectstorage_client.containers:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=container)
            acl_entries = [entry.strip() for entry in container.write_ACL.split(",")]
            if "*:*" in acl_entries or "*" in acl_entries:
                report.status = "FAIL"
                report.status_extended = f"Container {container.name} has unrestricted write ACL allowing all authenticated users to write."
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Container {container.name} has restricted write ACL."
                )

            findings.append(report)

        return findings

References