RDS snapshot is not publicly shared

​

What this check verifies

RDS DB snapshots and DB cluster snapshots with public visibility (shared with all AWS accounts) are detected. Snapshots limited to specific accounts or kept private are identified as restricted.

​

Risk

Public RDS snapshots expose full database copies to all AWS accounts, risking:

• Loss of confidentiality via data exfiltration (PII, secrets)
• Offline cracking of hashes and schema reconnaissance
• Credential harvesting from dumps enabling lateral movement This directly compromises confidentiality and fuels targeted attacks.

​

Recommendation

Keep RDS snapshots and cluster snapshots private. Share only with explicit AWS account IDs using least privilege and time-bound access. Enforce guardrails to block public visibility, require approvals for sharing, and audit snapshot permissions. Use encryption with strict key policies to control who can restore data.

​

Remediation

​

References

• https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/RDS/public-snapshots.html
• https://docs.aws.amazon.com/config/latest/developerguide/rds-snapshots-public-prohibited.html
• https://support.icompaas.com/support/solutions/articles/62000127056-ensure-rds-snapshots-and-cluster-snapshots-are-not-public

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_snapshots_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks