Profile Applicability:
- Level 1
Description:
Amazon RDS Snapshots and Cluster Snapshots are backup copies of your RDS instances and clusters. By default, RDS snapshots are private, meaning only the AWS account that created them can access them. However, if snapshots are made public, any AWS account can access them, which can lead to security and data leakage risks. This SOP ensures that RDS snapshots and cluster snapshots are not public to maintain data confidentiality and security.
Rationale:
Security: Publicly accessible snapshots can lead to unauthorized access and potential data breaches. Ensuring snapshots remain private ensures data security.
Compliance: For organizations following compliance frameworks like PCI-DSS, SOC 2, or HIPAA, keeping backups private is essential to meet regulatory requirements for data protection.
Best Practices: Following AWS security best practices requires ensuring that backup data is not exposed to the public.
Impact:
Pros:
Prevents Data Exposure: By ensuring snapshots remain private, you mitigate the risk of sensitive data being exposed to unauthorized parties.
Compliance: Ensures compliance with data protection regulations and security best practices.
Risk Mitigation: Reduces the risk of accidental or intentional data leaks.
Cons:
Access Restrictions: While ensuring privacy, it might require more complex management of access for team members who need to work with the snapshots.
Additional Monitoring: You will need to implement monitoring processes to ensure that snapshots are not unintentionally made public.
Default Value:
By default, RDS snapshots and Cluster snapshots are private. They must be explicitly made public by the user or the AWS account performing the snapshot operation.
Pre-requisite:
AWS IAM Permissions:
rds:DescribeDBSnapshots
rds:ModifyDBSnapshot
rds:DescribeDBClusterSnapshots
rds:ModifyDBClusterSnapshot
AWS CLI installed and configured.
Ensure you have access to all RDS snapshots and cluster snapshots for the AWS account you are auditing.
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to Amazon RDS under Services.
In the RDS Dashboard, go to Snapshots.
Review all RDS Snapshots and Cluster Snapshots listed in the Snapshots section.
For each snapshot, check the Public status:
If Public is set to Yes, the snapshot is public, and it needs to be made private.
If Public is set to No, the snapshot is private, as it should be.
If any snapshot is public, click on the snapshot, then select Modify and ensure Public Snapshot is set to No.
Save the changes and verify that the snapshot is now private.
Using AWS CLI:
To check if RDS snapshots are public, run the following command:
aws rds describe-db-snapshots --query 'DBSnapshots[*].{DBSnapshotIdentifier:DBSnapshotIdentifier,Public:Public}'Review the output:
If Public is true, the snapshot is public.
If Public is false, the snapshot is private.
To modify a snapshot to make it private, run:
aws rds modify-db-snapshot --db-snapshot-identifier <snapshot-id> --no-public
To check Cluster Snapshots, use the following command:
aws rds describe-db-cluster-snapshots --query 'DBClusterSnapshots[*].{DBClusterSnapshotIdentifier:DBClusterSnapshotIdentifier,Public:Public}'Review the output and repeat the modification if the snapshot is public:
aws rds modify-db-cluster-snapshot --db-cluster-snapshot-identifier <snapshot-id> --no-public
Implementation Steps:
Using AWS Console:
Log in to the AWS Management Console and navigate to Amazon RDS.
In the RDS Dashboard, go to Snapshots and check the list of RDS Snapshots and Cluster Snapshots.
If any snapshot is marked as public, click on it, select Modify, and change the Public Snapshot option to No.
Click Continue, and then Apply Changes to make the snapshot private.
Repeat the process for all snapshots to ensure no snapshots are public.
Using AWS CLI:
To check for public RDS snapshots, run:
aws rds describe-db-snapshots --query 'DBSnapshots[*].{DBSnapshotIdentifier:DBSnapshotIdentifier,Public:Public}'For Cluster Snapshots, run:
aws rds describe-db-cluster-snapshots --query 'DBClusterSnapshots[*].{DBClusterSnapshotIdentifier:DBClusterSnapshotIdentifier,Public:Public}'To make a snapshot private, use:
aws rds modify-db-snapshot --db-snapshot-identifier <snapshot-id> --no-public
For cluster snapshots, use:
aws rds modify-db-cluster-snapshot --db-cluster-snapshot-identifier <snapshot-id> --no-public
Backout Plan:
Using AWS Console:
If changing the public snapshot setting causes issues, sign in to the AWS Management Console.
Navigate to Amazon RDS, select the snapshot, and click Modify.
Re-enable public access if required (not recommended for security reasons).
Save the changes and verify that the snapshot is public again.
Using AWS CLI:
To revert the snapshot back to public access (though not recommended for security), run the following command:
aws rds modify-db-snapshot --db-snapshot-identifier <SNAPSHOT_ID> --public true
Verify that the snapshot is now public:
aws rds describe-db-snapshots --db-snapshot-identifier <SNAPSHOT_ID>