aws ec2 describe-snapshots

aws ec2 modify-snapshot-attribute --snapshot-id SNAPSHOT_ID --remove-group all

import boto3

class EBSSnapshotChecker:
    def __init__(self):
        self.ec2_client = boto3.client('ec2')

    def get_public_snapshots(self):
        failures = []
        response = self.ec2_client.describe_snapshots(OwnerIds=['self'])
        for snapshot in response['Snapshots']:
            if self.is_snapshot_public(snapshot):
                failures.append(snapshot)
        return failures

    def is_snapshot_public(self, snapshot):
        for permission in snapshot.get("Permissions", []):
            if permission.get("Group", "") == "all":
                return True
        return False

    def remediate_public_snapshot(self, snapshot_id):
        self.ec2_client.modify_snapshot_attribute(
            SnapshotId=snapshot_id,
            Attribute='createVolumePermission',
            OperationType='remove',
            GroupNames=['all']
        )
        print(f"Snapshot {snapshot_id} has been remediated.")

# Instantiate the class
checker = EBSSnapshotChecker()

# Get public snapshots
public_snapshots = checker.get_public_snapshots()

# Remediate public snapshots
for snapshot in public_snapshots:
    checker.remediate_public_snapshot(snapshot['SnapshotId'])

# EBS snapshot resource
resource "aws_ebs_snapshot" "example" {
  snapshot_id = "SNAPSHOT_ID_TO_PROTECT" # replace with the snapshot ID or create from volume, etc.
  # ...other required arguments...
}

# REMOVE any resource like this that grants public access:
# resource "aws_ebs_snapshot_create_volume_permission" "public" {
#   snapshot_id = aws_ebs_snapshot.example.id
#   group_names = ["all"] # this makes the snapshot public
# }

# If you manage sharing via Terraform and need to keep *account-level* sharing,
# use aws_ebs_snapshot_create_volume_permission without the "all" group:
resource "aws_ebs_snapshot_create_volume_permission" "shared_accounts" {
  snapshot_id = aws_ebs_snapshot.example.id

  # List only specific AWS account IDs that should retain access
  account_ids = [
    "SHARED_AWS_ACCOUNT_ID_1",
    "SHARED_AWS_ACCOUNT_ID_2",
  ]
}