# Ensure there are no EBS Snapshots set as Public

- Source: https://support.icompaas.com/support/solutions/articles/62000086773-ensure-there-are-no-ebs-snapshots-set-as-public
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [HIPAA Readiness](https://support.icompaas.com/support/solutions/62000039493) › [AWS - HIPAA](https://support.icompaas.com/support/solutions/folders/62000060465)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Description:

Elastic Block Store is a web service that provides block-level storage volumes for use with EC2 instances. EBS volumes are highly available and reliable storage volumes that can be attached to any running instance and used as a hard drive.

If EBS Snapshots are made public, unauthorized users may be able to gain access to the data on the server. Ensure there are no EBS snapshots set to public. We can achieve the same by modifying the permissions of a snapshot, and you can share it with the AWS accounts that you specify.

### Rationale:

Allowing public access to EBS Snapshots content may aid an adversary in identifying weaknesses in the affected account's use or configuration or data on the server.

### Impact:

By modifying the permissions of a snapshot, you can share it with the AWS accounts that you specify. Users that you have authorized can use the snapshots you share as the basis for creating their own EBS volumes, while your original snapshot remains unaffected.

### Default value:

By default, the EBS snapshot is private.

#### Pre-requisites:

1.  Sign in as an admin or IAM user with the required permissions
    
2.  If the selected snapshot is publicly accessible then only follow the implementation steps
    

### Remediation:

### Audit:

1.  Sign in to AWS Management console 
    
2.  Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/")
    
3.  Choose **Snapshots** under **Elastic Block Store** in the left navigation pane.
    

  

![](https://support.icompaas.com/assets/kb/2fa47a56d8c365c6.png)

4\. Select the snapshot you want to examine, it shows up the details in the bottom panel.

![](https://support.icompaas.com/assets/kb/303ad7f393cfc1f8.png)

  

5\. Click on the Permissions tab and check the snapshot access permissions. 

![](https://support.icompaas.com/assets/kb/09dd3848a4800902.png)

6\. If the EC2 dashboard displays the following status: "**This snapshot is currently Public.**", then the selected EBS volume snapshot is publicly accessible

#### Implementation Steps:

  1. Sign in to AWS Management Console

  2. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/")

  3. Choose **Snapshots** under **Elastic Block Store** in the left navigation pane.

![](https://support.icompaas.com/assets/kb/ef0aeb92f60f0395.png)

  

![](https://support.icompaas.com/assets/kb/ee6a546303beee18.png)

  4. Select the snapshot that you want to change.

![](https://support.icompaas.com/assets/kb/d19ef0b07e474bc4.png)

5\. Click on the **Actions** button on the top and select **Modify Permissions.**

**![](https://support.icompaas.com/assets/kb/ccc5dc396184effc.png)**

**6\. In the **Modify Permissions** dialog box, perform the following actions:**

1.  **Select **Private** to make the selected EBS snapshot private.**
    
2.  **Within the **AWS Account Number** box, enter the ID number of the AWS account with whom you want to share the selected volume snapshot and click **Add Permission** to confirm the action.**
    
3.  **Click **Save** to apply the changes.**
    

**![](https://support.icompaas.com/assets/kb/1da279b6d896f458.png)**

#### CLI Remediation:

  

aws ec2 modify-snapshot-attribute  
  --region us-east-1  
  --snapshot-id snap-0ee33391e721cfe2f  
  --attribute createVolumePermission  
  --operation-type add  
  --user-ids 123456789012

#### Backout plan:

To make the snapshot publicly accessible follow the implementation steps and select **public** in **Modify Permissions** dialog box opened and click on **save**.

**Resources:**

-   [https://docs.aws.amazon.com/ebs/?id=docs\_gateway](https://docs.aws.amazon.com/ebs/?id=docs_gateway "https://docs.aws.amazon.com/ebs/?id=docs_gateway")
    
-   [https://aws.amazon.com/ebs/?ebs-whats-new.sort-by=item.additionalFields.postDateTime&ebs-whats-new.sort-order=desc](https://aws.amazon.com/ebs/?ebs-whats-new.sort-by=item.additionalFields.postDateTime&ebs-whats-new.sort-order=desc "https://aws.amazon.com/ebs/?ebs-whats-new.sort-by=item.additionalFields.postDateTime&ebs-whats-new.sort-order=desc")

## Related compliance guidance

- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The Security Rule safeguards this readiness item belongs to, with a phased implementation roadmap and the evidence OCR expects.
- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most healthcare customers ask for a SOC 2 report alongside HIPAA assurances; the two share most technical controls.