Description

Ensure that Amazon EBS snapshots are not shared publicly (with the 'all' group), and that the account-level EBS snapshot public access block setting is enabled to prevent any snapshot from being made public, whether intentionally or by mistake.

Rationale

A publicly shared EBS snapshot can be copied and restored by any AWS account in the world, potentially exposing the entire contents of the original volume, including application data, configuration files, and any credentials or secrets stored on disk. Enabling the account-level Block public access setting for EBS snapshots provides a strong, centrally enforced safeguard against snapshots being made public, whether through a misconfigured sharing permission or a scripting error.

Impact

  • Prevents EBS snapshot data from being exposed to the public or to unintended AWS accounts

  • Provides a centrally enforced safeguard against a whole class of accidental public exposure

  • May require exempting specific, intentionally public snapshots (for example, a published open-source AMI's underlying snapshot) if that use case exists

Default Value

The account-level Block public access setting for EBS snapshots is not enabled by default; individual snapshot permissions default to private, but nothing prevents them from later being made public unless the account-level block is enabled.

Pre-Requisites

  • IAM permissions to view and modify EBS snapshot permissions and the account-level snapshot block public access setting (ec2:ModifySnapshotAttribute, ec2:EnableSnapshotBlockPublicAccess)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to EC2 > Snapshots.

  3. Select each snapshot and review its Permissions tab to confirm it is not shared with Public.

  4. Navigate to EC2 > Account attributes > EBS encryption / Snapshot settings (or use the CLI: aws ec2 get-snapshot-block-public-access-state) and confirm the account-level Block public access for snapshots setting is enabled (block-all-sharing or block-new-sharing).

  5. If any snapshot is public, or the account-level block is not enabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to EC2 > Snapshots, select any snapshot that is shared publicly, open the Permissions tab, and remove Public access, restricting sharing to specific, approved AWS account IDs only if sharing is genuinely required.

  3. Navigate to Account attributes (or EC2 Dashboard > Settings > Data protection and security) and locate the Snapshot settings section.

  4. Enable Block public access for snapshots, choosing Block all sharing (recommended) or Block new sharing, depending on whether any snapshots must remain shared with specific existing accounts.

  5. Save the setting and confirm the account attribute now reflects the enabled block.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Account attributes > Snapshot settings.

  3. Disable Block public access for snapshots.

Reference