Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
networking_security_group_allows_rdp_from_internet
OpenStack security groups are evaluated to verify that RDP (port 3389) is not exposed to the Internet (0.0.0.0/0 or ::/0). Security groups act as virtual firewalls controlling Windows instance traffic. Unrestricted RDP access violates least privilege and creates significant attack surface. Best practices recommend restricting RDP to known IP ranges, RD Gateway, or VPN.
networking_security_group_allows_ssh_from_internet
OpenStack security groups are evaluated to verify that SSH (port 22) is not exposed to the Internet (0.0.0.0/0 or ::/0). Security groups act as virtual firewalls controlling instance traffic. Unrestricted SSH access violates least privilege and creates significant attack surface. Best practices recommend restricting SSH to known IP ranges, bastion hosts, or VPN gateways.
networking_subnet_dhcp_disabled
OpenStack subnets are evaluated to verify that DHCP is enabled (enable_dhcp=True). DHCP automatically assigns IP addresses, DNS servers, and gateway information to instances at boot. Subnets with DHCP disabled require manual configuration, increasing operational complexity and IP conflict risk. Enable DHCP to simplify deployment and ensure cloud-init functionality.
objectstorage_container_acl_not_globally_shared
OpenStack Swift containers are evaluated to verify that the read ACL does not use *:* (global sharing). The *:* ACL grants read access to all authenticated users from any project in the OpenStack deployment, violating project isolation and the principle of least privilege.
objectstorage_container_listing_disabled
OpenStack Swift containers are evaluated to verify that public container listings are disabled. The .rlistings ACL allows users with read access to list all objects within the container. When combined with .r:*, this enables unauthenticated users to enumerate all objects, facilitating targeted data exfiltration.
objectstorage_container_metadata_sensitive_data
OpenStack Swift container metadata is evaluated to detect sensitive data such as passwords, API keys, secrets, and private keys. Container metadata is accessible to any user with read access to the container. Storing secrets in metadata exposes them to unauthorized access and credential theft.
objectstorage_container_public_read_acl_disabled
OpenStack Swift containers are evaluated to verify that anonymous read access is not granted. The .r:* ACL allows any unauthenticated user on the internet to read objects in the container. This is a critical exposure that can lead to data leaks, especially when containers hold sensitive information such as backups, logs, or application data.
objectstorage_container_sync_not_enabled
OpenStack Swift containers are evaluated to verify that container sync is not configured. Container sync replicates objects to another Swift cluster, potentially outside the organization's control. Unauthorized sync configurations can be used for data exfiltration to external clusters.
objectstorage_container_versioning_enabled
OpenStack Swift containers are evaluated to verify that object versioning is enabled. Versioning preserves previous versions of objects when they are overwritten or deleted, enabling recovery from accidental modifications, ransomware attacks, and data corruption.
objectstorage_container_write_acl_restricted
OpenStack Swift containers are evaluated to verify that write access is restricted. The *:* write ACL allows any authenticated user from any project to create, modify, or delete objects. The * write ACL similarly grants unrestricted write access. Both configurations violate the principle of least privilege.