Lightsail instance has automated snapshots enabled

Check ID: lightsail_instance_automated_snapshots
Provider: AWS
Service: lightsail
Severity: MEDIUM
Categories: resilience
Resource type: Other

What this check verifies

Amazon Lightsail instances with automatic daily snapshots enabled are identified. The evaluation checks if an instance is configured to take recurring snapshots at a scheduled time.

Risk

Absent automation, data lacks point-in-time recovery, increasing availability risk from accidental deletion, corruption, or ransomware. Failed updates or compromise hinder quick rollback, degrading integrity and extending RPO/RTO, causing prolonged outages.

Recommendation

Enable automatic snapshots on Lightsail instances and align the schedule with low-traffic windows. Apply least privilege to snapshot create/delete, and regularly test restores. Use defense in depth: retain multiple versions and replicate backups for critical workloads across regions or accounts.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lightsail enable-add-on --region <REGION> --resource-name <example_resource_name> --add-on-request addOnType=AutoSnapshot

# Enable automatic snapshots for a Lightsail instance
resource "aws_lightsail_instance" "<example_resource_name>" {
  name              = "<example_resource_name>"
  availability_zone = "<example_az>"
  blueprint_id      = "<example_blueprint_id>"
  bundle_id         = "<example_bundle_id>"

  add_on {
    type   = "AutoSnapshot"  # Critical: enables automatic snapshots
    status = "Enabled"       # Critical: turns the add-on on
  }
}

# CloudFormation: Enable automatic snapshots for a Lightsail instance
Resources:
  <example_resource_name>:
    Type: AWS::Lightsail::Instance
    Properties:
      InstanceName: <example_resource_name>
      AvailabilityZone: <example_az>
      BlueprintId: <example_blueprint_id>
      BundleId: <example_bundle_id>
      AddOns:
        - AddOnType: AutoSnapshot  # Critical: enables automatic snapshots for the instance

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = lightsail_instance_automated_snapshots. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lightsail database public access disabled Lightsail instance has no publicly accessible ports

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires