1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in with your credentials.
2. Navigate to DocumentDB Service: Click on the “Services” dropdown menu at the top left corner of the console, then select “DocumentDB” under the Database category.
3. Select DocumentDB Cluster: From the DocumentDB dashboard, select the DocumentDB cluster for which you want to remediate the public snapshot issue.
4. Modify Snapshot Settings:
   • In the left-hand navigation pane, click on “Snapshots” to view the list of snapshots associated with the selected cluster.
   • Identify the public snapshot(s) that need to be remediated.
   • Select the public snapshot by clicking on the checkbox next to it.
5. Update Snapshot Permissions:
   • Click on the “Actions” dropdown menu above the list of snapshots.
   • Select “Modify Snapshot Attribute” from the dropdown menu.
   • In the Modify Snapshot Attribute window, uncheck the option for “Public” to make the snapshot private.
   • Click on the “Modify Snapshot Attribute” button to save the changes.
6. Verify Changes:
   • Once the modification is complete, verify that the snapshot is no longer public by checking the snapshot permissions.
   • You can also try accessing the snapshot URL to confirm that it is no longer accessible publicly.
7. Repeat for Other Public Snapshots: If there are multiple public snapshots across different clusters, repeat the above steps for each affected snapshot to ensure all snapshots are private.

​

1. Identify the Public Snapshots: Use the AWS SDK for Python (Boto3) to list all the DocumentDB cluster snapshots in your account and identify which snapshots are public.
2. Modify Snapshot Permissions: For each public snapshot identified, modify the permissions to make them private. You can do this by removing the “all” permission grants and adding specific AWS account IDs or IAM roles that should have access to the snapshots.

import boto3

def remediate_public_snapshots():
    client = boto3.client('rds')

    # List all DocumentDB cluster snapshots
    response = client.describe_db_cluster_snapshots()

    for snapshot in response['DBClusterSnapshots']:
        snapshot_identifier = snapshot['DBClusterSnapshotIdentifier']
        snapshot_arn = snapshot['DBClusterSnapshotArn']
        
        # Check if the snapshot is public
        if snapshot['PubliclyAccessible']:
            print(f"Snapshot {snapshot_identifier} is public. Modifying permissions...")
            
            # Revoke public access
            response = client.modify_db_cluster_snapshot_attribute(
                DBClusterSnapshotIdentifier=snapshot_identifier,
                AttributeName='restore',
                ValuesToRemove=['all']
            )
            
            print(f"Snapshot {snapshot_identifier} permissions updated.")
        else:
            print(f"Snapshot {snapshot_identifier} is private.")

if __name__ == '__main__':
    remediate_public_snapshots()

aws docdb modify-db-cluster-snapshot-attribute \
  --db-cluster-snapshot-identifier {{asset_label}} \
  --attribute-name restore \
  --values-to-remove 'all'

1. Using AWS CLI (recommended for automation):
   aws docdb modify-db-cluster-snapshot-attribute \
     --db-cluster-snapshot-identifier DOCDB_SNAPSHOT_IDENTIFIER \
     --attribute-name restore \
     --values-to-remove 'all' \
     --region AWS_REGION
   
   Substitute:
   • DOCDB_SNAPSHOT_IDENTIFIER with your snapshot ID.
   • AWS_REGION with the region of the snapshot.
2. Or via Console (manual):
   • Go to Amazon DocumentDB → “Snapshots”.
   • Select the manual cluster snapshot.
   • Choose “Share snapshot”.
   • Remove all from the list of accounts.
   • Save.