More Info:
Your EC2 instance snapshots should not be publicly accessible. This is to avoid exposing your private data.Risk Level
CriticalAddress
SecurityCompliance Standards
HIPAA, NIST, HITRUST, SOC2, GDPR, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
- Sign in to the AWS Management Console.
- Navigate to the EC2 service.
- Select Snapshots from the navigation pane.
- Identify public snapshots:
- Look for snapshots listed in the console that have permissions set to “all”.
- Select the public snapshot.
- Modify Snapshot Permissions:
- Click on Actions > Modify Snapshot Permissions.
- Remove the “all” group permission if it exists.
- Add or modify permissions as necessary.
- Repeat for other public snapshots:
- Repeat the above steps for all public snapshots identified.
Using CLI
Using CLI
- List EBS Snapshots:
- Identify public snapshots:
- Look for snapshots where the volume permissions include the “all” group.
- Modify Snapshot Permissions:
SNAPSHOT_ID with the identifier of the public snapshot.
4. Repeat for other public snapshots:- Repeat the modification command for all public snapshots identified.
Using Python
Using Python
Here’s a Python script to identify and remediate public EBS snapshots:This Python script identifies public EBS snapshots by checking if the permissions include the “all” group and then remediates them by removing the permission.Ensure to have appropriate IAM permissions for modifying EBS snapshots if you’re using AWS CLI or Python script.