Check ID: ec2_ebs_public_snapshot
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Volume

​
What this check verifies

EBS snapshots with public sharing permissions (accessible by all AWS accounts) are identified, as opposed to snapshots shared privately with specific accounts.

​
Risk

Public snapshots expose full volume contents, harming confidentiality. Any account can create a volume from the snapshot to read files, secrets, or database data, enabling data exfiltration, broad reconnaissance, and facilitating lateral movement.

​
Recommendation

Keep snapshots private and share only with specific accounts under least privilege. Enable Block public access for Amazon EBS snapshots regionally. Prefer CMEK encryption and avoid sharing keys broadly. Regularly review sharing permissions and monitor snapshot usage.

​
Remediation

aws ec2 modify-snapshot-attribute —snapshot-id <EC2_SNAPSHOT_ID> —attribute createVolumePermission —operation-type remove —group-names all

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_ebs_public_snapshot. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks