Description

Ensure that block public access for Amazon EBS snapshots is set to block all sharing in every region in use. This account-level, per-region setting controls whether EBS snapshots can be shared publicly. The Block all public sharing mode blocks every public share, including snapshots that were already public, while Block new public sharing only prevents new public shares.

Rationale

A publicly shared EBS snapshot can be copied by any AWS account, exposing the full disk contents, such as application data, configuration files, credentials and keys. Once a copy is made in another account, the data leak cannot be reversed. Blocking only new public sharing leaves snapshots that are already public accessible. Setting block public access to block all sharing in every active region removes this exposure and prevents accidental public sharing in the future.

Impact

  • Prevents EBS snapshots from being publicly accessible, including snapshots that were made public in the past

  • Sharing snapshots with specific AWS accounts is not affected

  • Any process that relies on publicly shared snapshots stops working in that region

Default Value

Block public access for EBS snapshots is disabled by default in every region, so snapshots can be shared publicly.

Pre-Requisites

  • IAM permissions: ec2:GetSnapshotBlockPublicAccessState, ec2:EnableSnapshotBlockPublicAccess and ec2:DisableSnapshotBlockPublicAccess

  • Confirmation that no workload or partner relies on snapshots being publicly shared

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select EC2 Dashboard.

  3. Under Account attributes, choose Data protection and security.

  4. In the Block public access for EBS snapshots section, check the current setting.

  5. Repeat for each region in use.

  6. If the setting is not Block all public sharing, follow the implementation steps.

CLI:

Show the block public access state for EBS snapshots in a region:

aws ec2 get-snapshot-block-public-access-state --region <REGION>

A region fails if State is block-new-sharing or unblocked. Only regions that contain EBS snapshots are evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select EC2 Dashboard.

  3. Under Account attributes, choose Data protection and security.

  4. In the Block public access for EBS snapshots section, choose Manage.

  5. Select Block public access, then select Block all public sharing.

  6. Choose Update.

  7. Repeat for each region in use.

CLI:

Block all public sharing of EBS snapshots in a region:

aws ec2 enable-snapshot-block-public-access --state block-all-sharing --region <REGION>

Backout Plan

Before making changes, save the current state:

aws ec2 get-snapshot-block-public-access-state --region <REGION> > snapshot-bpa-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select EC2 Dashboard.

  3. Under Account attributes, choose Data protection and security.

  4. In the Block public access for EBS snapshots section, choose Manage.

  5. Restore the previous setting from the saved backup (Block new public sharing, or clear Block public access).

  6. Choose Update.

CLI:

Run only one of the following commands, depending on the state in the saved backup. Do not run both.

If the backup shows block-new-sharing, restore that state:

aws ec2 enable-snapshot-block-public-access --state block-new-sharing --region <REGION>

If the backup shows unblocked, disable the block instead:

aws ec2 disable-snapshot-block-public-access --region <REGION>

Note: snapshots that were public before the block was enabled become publicly accessible again as soon as the block is disabled.

Reference