Nutanix AHV clusters hold every virtual machine an organisation runs on them, so whoever controls Prism, the Controller VMs or the encryption keys controls the whole estate. Many organisations moved to AHV as an alternative to VMware, and ransomware operators followed: the Akira group was recorded encrypting Nutanix AHV virtual machine disks from June 2025. This guide covers how authentication and authorisation work across Prism Element and Prism Central, how to govern administrator accounts and API service accounts, the security baseline Nutanix automates with SCMA, data-at-rest encryption and key management, and the misconfigurations that matter most. It is for virtualisation administrators, infrastructure security engineers and assessors.
Key takeaways
- Prism Central is the control plane to protect first: it manages many clusters, holds directory and SAML integration, pushes Flow firewall policy and issues API keys.
- Use directory or SAML sign-in with MFA for people, keep the built-in admin account for break-glass, and give each automation its own service account rather than sharing admin credentials.
- API keys belong to service accounts only, are shown once at creation and are managed through the v4 IAM API, not the Prism Central UI, so they need their own inventory and review.
- SCMA enforces the STIG-based baseline hourly by default, but high-strength passwords, AIDE and the login banner are off until you enable them.
- Encryption is only as good as the key manager: choose between the Local Key Manager and an external KMIP server deliberately, and back up keys before you need them.
How identity and access work in Nutanix AHV and Prism
A Nutanix cluster has two management layers. Prism Element runs on the Controller VMs (CVMs) of each cluster and manages that one cluster. Prism Central is a separate appliance that manages many clusters and sites. Prism listens on HTTPS port 9440 and redirects HTTP port 80 to it. A Prism service runs on every CVM, one is elected Prism Leader, and the cluster's external IP address always sits on the current leader.
| Layer | Scope | Authentication options | Security notes |
|---|---|---|---|
| Prism Element | One cluster | Local, Active Directory, LDAP | Cluster lockdown, CVM and host security settings, SSH keys |
| Prism Central | Many clusters and sites | Local, Active Directory, LDAP, SAML with an external identity provider | SAML lets the identity provider enforce MFA; also hosts IAM, Flow Network Security and the v4 APIs |
| CVM shell | One CVM, with cluster-wide tools such as ncli and allssh | SSH password or key | Cluster lockdown can disable password login; from AOS 7.3 Bash shell SSH access can be disabled |
| AHV host | One hypervisor host | SSH as root, normally reached from the CVM | Hypervisor security settings managed through ncli and SCMA |
| v4 REST APIs | Prism Central namespaces such as iam, vmm, clustermgmt | HTTP Basic or an IAM API key in the X-Ntnx-Api-Key header | API keys require Prism Central pc.2024.3 or later and AOS 7.0 or later |
Prism Central users can be directory service users, identified by user principal name, or identity provider users, identified by the SAML Name ID. Authorisation is expressed as authorisation policies that bind an identity to a role over a set of entities. Nutanix's API documentation uses the built-in Super Admin role in its examples, and Flow Network Security adds Flow Viewer, Flow Policy Author and Flow Admin roles. Review the full role list in your own Prism Central version before designing delegation, because roles and their permissions vary by release.
Admin roles and privileged access
- People through the identity provider: configure SAML on Prism Central so the identity provider enforces MFA and conditional access, and map groups to authorisation policies rather than granting rights to individuals. Use AD or LDAP on Prism Element where SAML is not available, over LDAPS. See the SAML Security Guide and LDAP Security Deep Dive Guide.
- Split by function: separate virtualisation operators, network security policy authors (Flow Policy Author), backup operators and auditors. Very few people need Super Admin across every entity.
- Keep admin local accounts for break-glass: the built-in admin account and CVM and host shell accounts should have long, vaulted passwords, be used only in emergencies and generate an alert when used. Nutanix's own API guidance recommends a dedicated account over the built-in admin account.
- Lock down the shell: use cluster lockdown (Prism settings) to add public keys with "New Public Key" and untick "Enable Remote Login with Password", so CVM access needs a key. On AOS 7.3 and later consider disabling Bash shell SSH access; internal port 22 traffic is then routed through an envoy proxy (Nutanix KB-20212).
- Isolate the management network: CVM, host, IPMI and Prism interfaces belong on a dedicated management VLAN reachable only from privileged access workstations or a jump host. See the Privileged Access Workstations Guide.
- Do not tie the cluster to the domain it protects: if Active Directory is lost to ransomware, administrators still need a way in. Keep vaulted local break-glass access and test it. The Backup Identity Isolation Guide explains the same principle for backup platforms.
Integrations, API tokens and service accounts
Backup products, monitoring, infrastructure as code (Terraform, Ansible) and self-service portals all call Prism. Each of these is a non-human identity with cluster-wide reach.
| Credential | How it is created | Risk | Control |
|---|---|---|---|
| IAM API key | POST /api/iam/v4.0/authn/users/{extId}/keys with keyType API_KEY on a user of userType SERVICE_ACCOUNT | Shown once; not visible or manageable in the Prism Central UI, so easy to forget | Store in a secrets manager at creation, record owner and purpose, check lastUsedTime to find unused keys |
| Service account authorisation policy | POST /api/iam/v4.0/authz/authorization-policies | Examples bind Super Admin to all entities | Use a narrower role scoped to the entities the integration needs, such as VM and image management |
| Basic auth integration user | Local or directory account used by a tool | Password reused across tools; directory account subject to domain compromise | Prefer API keys on service accounts where supported; otherwise one account per tool, vaulted and rotated |
| CVM SSH keys | Cluster lockdown "New Public Key" | Keys copied between admins and scripts, never removed | One key per person or tool, reviewed quarterly. See the SSH Key Management Guide |
| KMS client certificate | CSR signed by your CA when an external KMS is configured | Whoever holds it can request cluster keys | Protect and renew like any machine identity certificate |
- Verify TLS: Nutanix's SDK examples show
verify_ssl = Falsefor testing and state it is not recommended in production. Replace the Prism certificate with one from your CA and keep verification on in every integration. - Backup integration accounts are a known target: the Akira Threat Actor Profile describes affiliates extracting backup credentials before encrypting hypervisor workloads, including AHV. Scope backup service accounts tightly and keep backup storage outside the cluster's administrative domain.
- Govern keys like any other API credential: see the API Key Management Guide for inventory, ownership and rotation practice.
Data-at-rest encryption and key management
| Option | What it is | Validation stated by Nutanix | Points to note |
|---|---|---|---|
| Software (native) encryption | AES-256 in AOS, using Intel AES-NI, applied after deduplication and compression | FIPS 140-2 Level 1 | Cluster level on AHV; space savings preserved |
| Self-encrypting drives (SED) | Drive-level encryption | FIPS 140-2 Level 2 | Keys not cached on the cluster: a cold boot or IPMI reset needs the KMS to unlock drives |
| Software plus SED | Both layers | As above | Defence in depth where policy demands it |
- Key hierarchy: a Data Encryption Key (DEK) encrypts data, a Key Encryption Key (KEK) encrypts the DEK, and with the Local Key Manager a Master Encryption Key (MEK) encrypts the KEK.
- Local Key Manager (LKM): runs on every CVM and splits the MEK with Shamir's Secret Sharing, so at least half the nodes (rounded up) are needed to rebuild keys. The MEK rotates yearly, on demand and when nodes are added or removed. LKM is simple, but the keys live with the data, which does not meet policies requiring key separation.
- External KMS: KMIP or TCG compliant servers, enrolled through a CSR process. This separates keys from data but makes the KMS a dependency for SED unlock after a cold boot, so it must be highly available and reachable during a disaster.
- Back up keys: Nutanix advises backing up DEKs after enabling encryption, protected with a strong password and stored securely. Test recovery before an incident. See the Cryptographic Key Management Guide.
- In transit: the encryption Nutanix describes inside a cluster covers replication factor traffic; protect management and replication between sites with TLS or network encryption as well.
Logging and detection
Nutanix logs live on the CVMs and Prism Central, and an attacker with cluster admin rights can tamper with them, so forward audit and system logs to a central SIEM. The Nutanix sources reviewed for this guide do not document the log forwarding settings, so take exact configuration from the Security Guide for your AOS and Prism Central release.
| What to detect | Where it shows | Why it matters |
|---|---|---|
| Sign-ins by the built-in admin or local accounts | Prism audit events, identity provider logs | Break-glass use or a bypass of SSO and MFA |
| New service accounts, API keys or authorisation policies | Prism Central IAM audit | Persistence through a long-lived key (MITRE ATT&CK T1098) |
| SSH to CVMs or hosts, especially with passwords | CVM and host auth logs | Interactive access is rare in normal operations (T1021.004) |
| Bulk VM power-off, snapshot or protection policy deletion | Prism audit, task history | Typical ransomware preparation before encryption (T1490) |
| Changes to cluster lockdown, SCMA settings or encryption | Prism audit, ncli history | Defence weakening |
| Flow policy moved from Enforced to Monitoring or deleted | Prism Central | Opens east-west paths |
| AIDE file integrity alerts | CVM and host, once enabled | Modified binaries or configuration |
Metrics: percentage of administrator sign-ins through SSO with MFA (target 100 per cent outside break-glass), number of API keys with no recorded owner (target zero), API keys unused for 90 days, SCMA compliance across clusters, mean time to apply AOS and AHV security updates, and percentage of production VMs covered by an Enforced Flow policy.
Hardening baseline
Nutanix's Security Configuration Management Automation (SCMA) continuously checks CVMs and AHV hosts against Nutanix's documented STIG baselines and puts non-compliant settings back. It is enabled by default and runs hourly unless changed. Some controls are opt-in, set with ncli cluster edit-cvm-security-params and ncli cluster edit-hypervisor-security-params (view with the matching get- commands):
| Setting | Default | Effect when enabled |
|---|---|---|
enable-high-strength-password | no | Minimum length 15, 8 characters must differ from the old password, last 24 remembered |
enable-aide | no | AIDE file integrity checking, run weekly |
enable-banner | no | Login consent banner (DoD text by default; customisable) |
enable-snmpv3-only (CVM) | false | Restricts SNMP to version 3 |
schedule | HOURLY | How often SCMA checks and remediates (HOURLY, DAILY, WEEKLY, MONTHLY) |
- Inventory: list clusters, Prism Central instances, AOS and AHV versions and support status, and every integration account and API key.
- Patch: apply AOS, AHV and Prism Central updates through the rolling upgrade workflow, which live-migrates VMs off each host before it reboots. Track Nutanix security advisories and the CISA KEV catalog.
- Identity: enable SAML with MFA on Prism Central, directory sign-in on Prism Element, and vault the local admin accounts.
- Shell access: enable cluster lockdown with keys only, and disable Bash SSH where your AOS version supports it.
- SCMA options: enable high-strength passwords, AIDE and the banner on CVMs and hosts, in a pilot cluster first; check with the
get-commands. - Encryption: choose LKM or external KMS, enable encryption, back up keys and test a restore.
- Segmentation: isolate the management network, and roll out Flow Network Security policies in Monitoring mode, review discovered traffic, then move them to Enforced. Rollback is returning a policy to Monitoring.
- Logging: forward Prism and CVM logs to the SIEM and build the detections above.
Small estates with one cluster may manage without Prism Central, but they lose SAML, IAM API keys and Flow; most organisations with more than one cluster or a security policy requiring MFA for administrators will need it. Large estates should manage authorisation policies and Flow categories as code so changes are reviewed.
Common misconfigurations
- Everyone is Super Admin: integrations and staff share the top role across all entities because the API examples use it.
- Prism and CVMs on a user-reachable network: management interfaces exposed to the general LAN or the internet give attackers a direct path to every VM.
- Password SSH left on CVMs and hosts: cluster lockdown not used, so stolen or reused passwords give shell access.
- Forgotten API keys: keys created through the API are not visible in the UI, so nobody reviews them, and a leaked key works until someone revokes it.
- External KMS unavailable in a disaster: SED clusters cannot unlock after a cold boot without the KMS, turning a power event into an outage.
- Backups inside the blast radius: backup copies on the same cluster or managed by the same directory accounts are encrypted with everything else, as described in the ESXi Ransomware Playbook for the comparable VMware case.
Framework mapping
| Control area | Nutanix feature | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|---|
| Baseline configuration | SCMA, STIG baselines | CM-2, CM-6 | PR.PS-01 |
| Administrator authentication | SAML, directory sign-in, cluster lockdown | IA-2, AC-2 | PR.AA-01 |
| Least privilege | Authorisation policies, Flow roles | AC-6, AC-6(5) | PR.AA-05 |
| Encryption at rest | Software encryption, SED, LKM or KMS | SC-28(1), SC-12 | PR.DS-01 |
| Integrity monitoring and logging | AIDE, audit forwarding | AU-2, AU-12 | DE.CM-01 |
| Patching | Rolling AOS and AHV upgrades | SI-2 | PR.PS-02 |
Practitioner checklist
- Put Prism Central, Prism Element, CVM, host and IPMI interfaces on an isolated management network.
- Enable SAML with MFA for Prism Central administrators and map identity provider groups to narrow authorisation policies.
- Vault the built-in admin and shell account passwords and alert on every use.
- Enable cluster lockdown with key-only SSH, and disable Bash SSH where supported.
- Give each integration its own service account and API key with a scoped role, recorded owner and secrets manager storage.
- Enable SCMA high-strength passwords, AIDE and the login banner on CVMs and hosts, and confirm the schedule.
- Enable data-at-rest encryption, back up keys and test recovery, including KMS availability after a cold boot.
- Roll out Flow Network Security policies from Monitoring to Enforced for production workloads.
- Forward Prism and CVM logs to the SIEM and alert on new keys, policy changes and bulk snapshot deletion.
- Keep backups outside the cluster's administrative and directory domain.
Standards and references
- Nutanix Cloud Bible: AOS Security
- Nutanix Cloud Bible: Prism Architecture
- Nutanix Cloud Bible: Flow Network Security
- Nutanix.dev: v4 API User Guide
- Nutanix.dev: v4 APIs, Using API Key Authentication
- NIST: SP 800-53 Rev. 5
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Hypervisor and Virtualisation Security Guide · VMware ESXi Hardening Guide · Akira Threat Actor Profile · Backup Security and Immutable Backup Guide