EBS volume has at least one snapshot

Check ID: ec2_ebs_volume_snapshots_exists
Provider: AWS
Service: ec2
Severity: HIGH
Categories: resilience, forensics-ready
Resource type: AwsEc2Volume

What this check verifies

EBS volumes are evaluated for the existence of at least one associated snapshot, identifying volumes without any point-in-time backup available.

Risk

Missing EBS snapshots removes point-in-time recovery. Accidental deletion, corruption, or ransomware can cause irrecoverable data loss and prolonged service outages, degrading data integrity and availability and complicating recovery and forensics.

Recommendation

Establish automated, policy-based EBS snapshot coverage for all volumes aligned to business RPO/RTO.

Schedule regular snapshots with retention controls
Encrypt snapshots and enforce least privilege access
Replicate to another Region/account for DR
Periodically test restores and document procedures

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 create-snapshot —region <REGION> —volume-id <VOLUME_ID>

# Create a snapshot for an existing EBS volume
resource "aws_ebs_snapshot" "<example_resource_name>" {
  volume_id = "<example_resource_id>" # Critical: creating this snapshot makes the volume pass the check
}

# CloudFormation: create a snapshot of an existing EBS volume
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Snapshot
    Properties:
      VolumeId: <example_resource_id>  # Critical: creates a snapshot for this volume to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_ebs_volume_snapshots_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EBS volume is protected by a backup plan EC2 Elastic IP address is not listed in Shodan

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires