Check ID: directoryservice_directory_snapshots_limit
Provider: AWS
Service: directoryservice
Severity: LOW
Categories: resilience
Resource type: Other

​
What this check verifies

AWS Directory Service directories with manual snapshot capacity fully consumed or nearly exhausted, based on current snapshot count relative to the directory’s maximum allowed.

​
Risk

With no remaining snapshot capacity, you cannot create new recovery points:
  • Reduced availability during outages or ransomware
  • Higher RPO from failed scheduled backups
  • Greater change risk (schema/OS updates) without a safe rollback

​
Recommendation

Adopt a snapshot lifecycle policy: rotate/expire old manual snapshots after verifying restores, and alert on low headroom. Prefer automated backups for cadence and retention. Enforce least privilege for snapshot creation. Design operations within the hard per-directory cap to prevent capacity exhaustion.

​
Remediation

Dashboard steps
  1. In the AWS Console, go to Directory Service > Directories and open <example_resource_id>
  2. Click Snapshots
  3. Select older snapshots with Type = Manual and click Delete snapshot, confirm
  4. Repeat until the number of manual snapshots is less than (manual limit - 2). For the default limit of 5, keep at most 2 manual snapshots
  5. Verify Remaining manual snapshots > 2 on the Snapshots page

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = directoryservice_directory_snapshots_limit. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks