Check ID:
Provider: AWS
Service:
Severity: CRITICAL
Categories:
Resource type:
documentdb_cluster_public_snapshotProvider: AWS
Service:
documentdbSeverity: CRITICAL
Categories:
internet-exposedResource type:
AwsRdsDbClusterSnapshotWhat this check verifies
Amazon DocumentDB manual cluster snapshot visibility is evaluated to detect snapshots marked as public instead of limited to specified AWS accounts.Risk
Public snapshots weaken confidentiality: any AWS account can restore and read database contents, enabling data exfiltration. They also aid lateral movement by revealing embedded secrets/config and reduce accountability when restores occur outside your account.Recommendation
Keep snapshot visibilityPrivate and share only with trusted accounts under least privilege. Prefer CMEK encryption to enforce key-based access and prevent public sharing. Periodically review sharing lists, restrict IAM permissions that alter visibility, and monitor for exposure as defense in depth.
Remediation
- CLI
- Dashboard steps
aws docdb modify-db-cluster-snapshot-attribute —db-cluster-snapshot-identifier <snapshot_id> —attribute-name restore —values-to-remove all
References
- https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore-share_cluster_snapshots.html#backup_restore-share_snapshots
- https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-3
- https://docs.aws.amazon.com/config/latest/developerguide/docdb-cluster-snapshot-public-prohibited.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = documentdb_cluster_public_snapshot. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks