Neptune cluster snapshot public prohibited remediation

Using Console

Using CLI

Follow these steps to modify the snapshot permissions using AWS CLI:

List Public Snapshots: Run the following AWS CLI command to identify any public Neptune DB cluster snapshots:

aws neptune describe-db-cluster-snapshots --query "DBClusterSnapshots[?PubliclyAccessible=='true']"

Update Snapshot Permissions: Modify the snapshot’s attributes to disable public access using the following command:

aws neptune modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier <snapshot-identifier> --attribute-name "restore" --values-to-remove "all"

Replace <snapshot-identifier> with the actual ID of the public snapshot you wish to modify.

Verify Changes: Run the describe-db-cluster-snapshots command again to ensure that the snapshot is no longer public:

aws neptune describe-db-cluster-snapshots --query "DBClusterSnapshots[?PubliclyAccessible=='true']"

Using Python

To remediate the issue of public Neptune DB Cluster Snapshots programmatically using Python, follow these steps:

Identify Public Snapshots: Use the AWS SDK for Python (Boto3) to identify any public Neptune DB cluster snapshots:

import boto3

client = boto3.client('neptune')

response = client.describe_db_cluster_snapshots()

for snapshot in response['DBClusterSnapshots']:
    if snapshot['PubliclyAccessible']:
        print(f"Public snapshot: {snapshot['DBClusterSnapshotIdentifier']}")

Modify Snapshot Permissions: For each identified public snapshot, modify its permissions to remove public access:

for snapshot in response['DBClusterSnapshots']:
    if snapshot['PubliclyAccessible']:
        client.modify_db_cluster_snapshot_attribute(
            DBClusterSnapshotIdentifier=snapshot['DBClusterSnapshotIdentifier'],
            AttributeName='restore',
            ValuesToRemove=['all']
        )
        print(f"Snapshot {snapshot['DBClusterSnapshotIdentifier']} is now private.")

Re-Verify: After making the changes, re-run the script to confirm that no public snapshots remain:

response = client.describe_db_cluster_snapshots()

public_snapshots = [snapshot for snapshot in response['DBClusterSnapshots'] if snapshot['PubliclyAccessible']]

if not public_snapshots:
    print("No public snapshots found.")
else:
    print("Some snapshots are still public.")

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Neptune cluster snapshot public prohibited remediation

Triage and Remediation

Remediation