# Ensure there are no public EBS snapshots - Source: https://support.icompaas.com/support/solutions/articles/a_1793292199758935-ensure-there-are-no-public-ebs-snapshots - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no Amazon EBS snapshot owned by the account is shared publicly. A snapshot is public when its create volume permissions include all AWS accounts (Group=all), which allows any AWS account to create a volume from it. Snapshots shared privately with specific accounts are not affected. **Rationale** A public snapshot exposes the full contents of the volume it was taken from. Any AWS account can create a volume from it and read files, secrets, credentials or database data, which can lead to data theft, reconnaissance of your environment and further attacks. Snapshots should be private and shared only with specific accounts. Block public access for EBS snapshots should also be enabled in each region. **Impact** - Prevents unknown accounts from creating volumes from your snapshots - Protects the confidentiality of data stored in snapshots - Accounts that currently use the public snapshot lose access unless it is shared with them explicitly - Enabling block public access with block-all-sharing applies to the whole region and stops public access to every publicly shared snapshot in that region, including snapshots that are public on purpose; use block-new-sharing instead if some snapshots must stay public **Default Value** EBS snapshots are private by default when created. A snapshot is public only if its permissions were explicitly changed. **Pre-Requisites** - IAM permissions: ec2:DescribeSnapshots, ec2:DescribeSnapshotAttribute, ec2:ModifySnapshotAttribute and ec2:EnableSnapshotBlockPublicAccess - A list of AWS accounts that still need access to each snapshot, so it can be shared with them explicitly **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Snapshots** under **Elastic Block Store**. 3. Choose the **Owned by me** filter. 4. Select each snapshot, choose **Actions**, then **Snapshot settings**, then **Modify permissions**, and check whether **Public** is selected. Choose **Cancel** without saving. 5. Repeat for each region in use. 6. If any snapshot is public, follow the implementation steps. **CLI:** List the snapshots owned by the account: aws ec2 describe-snapshots --owner-ids self --region --query "Snapshots\[\].\[SnapshotId,VolumeId,StartTime\]" --output table Show whether a snapshot is shared with all accounts: aws ec2 describe-snapshot-attribute --snapshot-id --attribute createVolumePermission --region --query "CreateVolumePermissions\[?Group=='all'\]" A snapshot fails if the second command returns any entry. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Snapshots** under **Elastic Block Store**. 3. Select the public snapshot. 4. Choose **Actions**, then **Snapshot settings**, then **Modify permissions**. 5. Select **Private**. 6. If other accounts still need the snapshot, add their account IDs under **Shared accounts**. 7. Choose **Save changes**. 8. Repeat for each affected snapshot in each region in use. **CLI:** Remove public access from the snapshot: aws ec2 modify-snapshot-attribute --snapshot-id --attribute createVolumePermission --operation-type remove --group-names all --region Share the snapshot with a specific account if it is still needed: aws ec2 modify-snapshot-attribute --snapshot-id --attribute createVolumePermission --operation-type add --user-ids --region Block all public sharing of snapshots in the region. Warning: this setting is region-wide and stops public access to every publicly shared snapshot in the region, including snapshots that are public on purpose. If some snapshots must stay public, use --state block-new-sharing instead, which only prevents new public sharing: aws ec2 enable-snapshot-block-public-access --state block-all-sharing --region **Backout Plan** Before making changes, save the current snapshot permissions: aws ec2 describe-snapshot-attribute --snapshot-id --attribute createVolumePermission --region > snapshot-permissions-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select the snapshot under **Snapshots**. 3. Choose **Actions**, then **Snapshot settings**, then **Modify permissions**. 4. Select **Public** (block public access for snapshots must be disabled first). 5. Choose **Save changes**. **CLI:** aws ec2 disable-snapshot-block-public-access --region aws ec2 modify-snapshot-attribute --snapshot-id --attribute createVolumePermission --operation-type add --group-names all --region Note: rolling back makes the snapshot and its data available to every AWS account again. **Reference** - [https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modifying-snapshot-permissions.html](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-modifying-snapshot-permissions.html) - [https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots.html](https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots.html) - [https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-snapshot-attribute.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-snapshot-attribute.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.