Although, more and more companies start to move their IT-Infrastructure from on-premise to public cloud solutions like Amazon Web Services (AWS) and Microsoft Azure, public cloud providers are not an option for every organization. This is where private cloud platforms come into play as they give organizations direct control over their information, can be more energy efficient than other on-premise hosting solutions, and offer companies the possibility to manage their data centers efficiently. OpenStack is a widely deployed, open-source private cloud platform many companies and universities use.

With companies and organizations moving their resources to the cloud, the security of the cloud deployment moves into focus. To ensure security in private and public cloud deployments, cloud security benchmarks are developed. The Center for Internet Security (CIS) maintains several benchmarks for public cloud providers like the AWS Foundations Benchmark or the Azure Foundations Benchmark.

As the number of deployed resources in cloud deployments can be extensive, tools for automated checking of these benchmarks are needed. Steampipe is such a tool. It offers automated checks for various cloud providers with good coverage of security standards and compliance benchmarks.

What is OpenStack?

What is Steampipe?

A Steampipe Plugin for OpenStack

How to Use

To use the Steampipe plugin, Steampipe first needs to be downloaded from the official website.  After completing all described steps, the following command can be executed to install the OpenStack plugin for Steampipe:

$ steampipe plugin install ernw/openstack

After the OpenStack Steampipe plugin is installed, the connection to the OpenStack deployment needs to be configured. There is a configuration file located at ~/.steampipe/config/openstack.spc. In this file, the following connection parameters need to be set:

connection "openstack" {
    plugin = "ernw/openstack"

    # Authentication information
    identity_endpoint = "https://example.com/identity/v3"
    username = "admin"
    password = "changeme"
    domain_id = "default"
    project_id = "3e666015f769bf30cda73a1a1e9b794a"
}

The connection parameters can also be set via environment variables as follows:

export OS_AUTH_URL=https://example.com/identity/v3
export OS_USERNAME=admin
export OS_PASSWORD=changeme
export OS_DOMAIN_ID=default
export OS_PROJECT_ID=3e666015f769bf30cda73a1a1e9b794a

For more information about the available configuration parameters take a look at the official documentation.

After configuring the connection parameters, everything is setup to query your OpenStack deployment. Simply run the following command to enter the Steampipe CLI:

$ steampipe query

Run a simple query to check that everything works as expected:

select
  name,
  description,
  email,
  enabled
from
  openstack_user;

+-------------------+---------------------------+-----------------------------+---------+
| name              | description               | email                       | enabled |
+-------------------+---------------------------+-----------------------------+---------+
| demo              | This is the demo user     | [email protected]            | true    |
| admin             | This is the admin user    | [email protected]       | true    |
| reader            | This is the readonly user | [email protected]      | true    |
+-------------------+---------------------------+-----------------------------+---------+

The plugin is very useful to check for security misconfigurations of deployed cloud resources e.g. The following query shows all users with no password expiry date set:

select
  name,
  description,
  email,
  enabled,
  lock_password,
  domain_id,
  password_expires_at,
  default_project_id
from
  openstack_user
where
  password_expires_at is null;

You can find all available tables documented here together with some example queries for each table.

Limitations

Currently, several limitations for the OpenStack Steampipe plugin exist. First, only the primary software components keystone, nova, neutron, and cinder are included. Moreover, as every software component has its own API, the versioning of those APIs differ. At the moment, the plugin uses the newest versions available, which can lead to backwards compatibility issues. Finally, not all data is extracted from the APIs but more and more tables will be implemented over time.

Outlook

In the future, more and more tables will be added to the Steampipe plugin for OpenStack. Besides more tables, Steampipe mods need to be created to automate the checking of common security flaws in the configuration of OpenStack cloud resources. This will be the next step to make the plugin even more usable. If you are interested in the project and you need more tables or mods, feel free to contribute or open an issue.

Cheers,
Gregor