# Ensure all EBS snapshots have public access blocked

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292239137133-ensure-all-ebs-snapshots-have-public-access-blocked
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that block public access for Amazon EBS snapshots is set to block all sharing in every region in use. This account-level, per-region setting controls whether EBS snapshots can be shared publicly. The **Block all public sharing** mode blocks every public share, including snapshots that were already public, while **Block new public sharing** only prevents new public shares.

**Rationale**

A publicly shared EBS snapshot can be copied by any AWS account, exposing the full disk contents, such as application data, configuration files, credentials and keys. Once a copy is made in another account, the data leak cannot be reversed. Blocking only new public sharing leaves snapshots that are already public accessible. Setting block public access to block all sharing in every active region removes this exposure and prevents accidental public sharing in the future.

**Impact**

-   Prevents EBS snapshots from being publicly accessible, including snapshots that were made public in the past
    
-   Sharing snapshots with specific AWS accounts is not affected
    
-   Any process that relies on publicly shared snapshots stops working in that region
    

**Default Value**

Block public access for EBS snapshots is disabled by default in every region, so snapshots can be shared publicly.

**Pre-Requisites**

-   IAM permissions: ec2:GetSnapshotBlockPublicAccessState, ec2:EnableSnapshotBlockPublicAccess and ec2:DisableSnapshotBlockPublicAccess
    
-   Confirmation that no workload or partner relies on snapshots being publicly shared
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **EC2 Dashboard**.
    
3.  Under **Account attributes**, choose **Data protection and security**.
    
4.  In the **Block public access for EBS snapshots** section, check the current setting.
    
5.  Repeat for each region in use.
    
6.  If the setting is not **Block all public sharing**, follow the implementation steps.
    

**CLI:**

Show the block public access state for EBS snapshots in a region:

aws ec2 get-snapshot-block-public-access-state --region <REGION>

A region fails if State is block-new-sharing or unblocked. Only regions that contain EBS snapshots are evaluated.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **EC2 Dashboard**.
    
3.  Under **Account attributes**, choose **Data protection and security**.
    
4.  In the **Block public access for EBS snapshots** section, choose **Manage**.
    
5.  Select **Block public access**, then select **Block all public sharing**.
    
6.  Choose **Update**.
    
7.  Repeat for each region in use.
    

**CLI:**

Block all public sharing of EBS snapshots in a region:

aws ec2 enable-snapshot-block-public-access --state block-all-sharing --region <REGION>

**Backout Plan**

Before making changes, save the current state:

aws ec2 get-snapshot-block-public-access-state --region <REGION> > snapshot-bpa-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **EC2 Dashboard**.
    
3.  Under **Account attributes**, choose **Data protection and security**.
    
4.  In the **Block public access for EBS snapshots** section, choose **Manage**.
    
5.  Restore the previous setting from the saved backup (**Block new public sharing**, or clear **Block public access**).
    
6.  Choose **Update**.
    

**CLI:**

Run only one of the following commands, depending on the state in the saved backup. Do not run both.

If the backup shows block-new-sharing, restore that state:

aws ec2 enable-snapshot-block-public-access --state block-new-sharing --region <REGION>

If the backup shows unblocked, disable the block instead:

aws ec2 disable-snapshot-block-public-access --region <REGION>

Note: snapshots that were public before the block was enabled become publicly accessible again as soon as the block is disabled.

**Reference**

-   [https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots.html](https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots.html)
    
-   [https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html](https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-snapshot-block-public-access.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-snapshot-block-public-access.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.