NeptuneDB cluster snapshot is not publicly shared

​

What this check verifies

Neptune DB manual cluster snapshot is evaluated to determine if its restore attributes allow access to all AWS accounts (public). A failed status in the report means the snapshot is publicly shared and can be copied or restored by any AWS account; PASS means it is not shared publicly.

​

Risk

Public snapshots compromise confidentiality of stored data and metadata. Attackers or third parties can:

• Copy or restore snapshots to external accounts.
• Access sensitive data contained in the snapshot.

​

Recommendation

Avoid public sharing and apply least privilege when granting snapshot access: share only with specific AWS accounts or roles. Use encryption, enforce automated policies and regular audits, and apply separation of duties and tagging to control and track snapshot access.

​

Remediation

​

References

• https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html#neptune-3
• https://docs.aws.amazon.com/config/latest/developerguide/neptune-cluster-snapshot-public-prohibited.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = neptune_cluster_public_snapshot. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks