All EBS snapshots have public access blocked

Check ID: ec2_ebs_snapshot_account_block_public_access
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2Volume

What this check verifies

EBS snapshots account/Region configuration for Block Public Access is assessed to see whether public sharing is fully blocked (block-all-sharing) versus only new sharing (block-new-sharing) or unblocked. The state indicates if any snapshot can be publicly shared.

Risk

Without block-all-sharing, previously public snapshots can remain accessible, exposing raw disk data. Impacts:

Loss of confidentiality (PII, keys, configs)
Unauthorized cloning enabling lateral movement
Cross-account copies create irreversible data leakage

Recommendation

Set Block Public Access for EBS snapshots to block-all-sharing in all active Regions. Apply least privilege and guardrails (SCPs) to prevent changes. Regularly inventory snapshots, remove public sharing, and use segregated accounts with strict reviews for any necessary external sharing.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 enable-snapshot-block-public-access —state block-all-sharing

resource "aws_ebs_snapshot_block_public_access" "<example_resource_name>" {
  state = "block-all-sharing" # CRITICAL: Blocks all public sharing of EBS snapshots in this Region
}

Resources:
  <example_resource_name>:
    Type: AWS::EC2::SnapshotBlockPublicAccess
    Properties:
      State: block-all-sharing  # CRITICAL: Blocks all public sharing of EBS snapshots in this Region to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_ebs_snapshot_account_block_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires