Description

Ensure that no Amazon EBS snapshot owned by the account is shared publicly. A snapshot is public when its create volume permissions include all AWS accounts (Group=all), which allows any AWS account to create a volume from it. Snapshots shared privately with specific accounts are not affected.

Rationale

A public snapshot exposes the full contents of the volume it was taken from. Any AWS account can create a volume from it and read files, secrets, credentials or database data, which can lead to data theft, reconnaissance of your environment and further attacks. Snapshots should be private and shared only with specific accounts. Block public access for EBS snapshots should also be enabled in each region.

Impact

  • Prevents unknown accounts from creating volumes from your snapshots

  • Protects the confidentiality of data stored in snapshots

  • Accounts that currently use the public snapshot lose access unless it is shared with them explicitly

  • Enabling block public access with block-all-sharing applies to the whole region and stops public access to every publicly shared snapshot in that region, including snapshots that are public on purpose; use block-new-sharing instead if some snapshots must stay public

Default Value

EBS snapshots are private by default when created. A snapshot is public only if its permissions were explicitly changed.

Pre-Requisites

  • IAM permissions: ec2:DescribeSnapshots, ec2:DescribeSnapshotAttribute, ec2:ModifySnapshotAttribute and ec2:EnableSnapshotBlockPublicAccess

  • A list of AWS accounts that still need access to each snapshot, so it can be shared with them explicitly

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Snapshots under Elastic Block Store.

  3. Choose the Owned by me filter.

  4. Select each snapshot, choose Actions, then Snapshot settings, then Modify permissions, and check whether Public is selected. Choose Cancel without saving.

  5. Repeat for each region in use.

  6. If any snapshot is public, follow the implementation steps.

CLI:

List the snapshots owned by the account:

aws ec2 describe-snapshots --owner-ids self --region <REGION> --query "Snapshots[].[SnapshotId,VolumeId,StartTime]" --output table

Show whether a snapshot is shared with all accounts:

aws ec2 describe-snapshot-attribute --snapshot-id <SNAPSHOT_ID> --attribute createVolumePermission --region <REGION> --query "CreateVolumePermissions[?Group=='all']"

A snapshot fails if the second command returns any entry.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Snapshots under Elastic Block Store.

  3. Select the public snapshot.

  4. Choose Actions, then Snapshot settings, then Modify permissions.

  5. Select Private.

  6. If other accounts still need the snapshot, add their account IDs under Shared accounts.

  7. Choose Save changes.

  8. Repeat for each affected snapshot in each region in use.

CLI:

Remove public access from the snapshot:

aws ec2 modify-snapshot-attribute --snapshot-id <SNAPSHOT_ID> --attribute createVolumePermission --operation-type remove --group-names all --region <REGION>

Share the snapshot with a specific account if it is still needed:

aws ec2 modify-snapshot-attribute --snapshot-id <SNAPSHOT_ID> --attribute createVolumePermission --operation-type add --user-ids <ACCOUNT_ID> --region <REGION>

Block all public sharing of snapshots in the region. Warning: this setting is region-wide and stops public access to every publicly shared snapshot in the region, including snapshots that are public on purpose. If some snapshots must stay public, use --state block-new-sharing instead, which only prevents new public sharing:

aws ec2 enable-snapshot-block-public-access --state block-all-sharing --region <REGION>

Backout Plan

Before making changes, save the current snapshot permissions:

aws ec2 describe-snapshot-attribute --snapshot-id <SNAPSHOT_ID> --attribute createVolumePermission --region <REGION> > snapshot-permissions-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select the snapshot under Snapshots.

  3. Choose Actions, then Snapshot settings, then Modify permissions.

  4. Select Public (block public access for snapshots must be disabled first).

  5. Choose Save changes.

CLI:

aws ec2 disable-snapshot-block-public-access --region <REGION>
aws ec2 modify-snapshot-attribute --snapshot-id <SNAPSHOT_ID> --attribute createVolumePermission --operation-type add --group-names all --region <REGION>

Note: rolling back makes the snapshot and its data available to every AWS account again.

Reference