> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# EC2 Instance Snapshots Should Not Be Public

### More Info:

Your EC2 instance snapshots should not be publicly accessible. This is to avoid exposing your private data.

### Risk Level

Critical

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* FedRAMP
* GDPR
* HIPAA
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        1. **Sign in to the AWS Management Console**.
        2. **Navigate to the EC2 service**.
        3. **Select Snapshots from the navigation pane**.
        4. **Identify public snapshots**:
           * Look for snapshots listed in the console that have permissions set to "all".
        5. **Select the public snapshot**.
        6. **Modify Snapshot Permissions**:
           * Click on Actions > Modify Snapshot Permissions.
           * Remove the "all" group permission if it exists.
           * Add or modify permissions as necessary.
        7. **Repeat for other public snapshots**:
           * Repeat the above steps for all public snapshots identified.

        #
      </Accordion>

      <Accordion title="Using CLI">
        1. **List EBS Snapshots**:

        ```bash theme={null}
        aws ec2 describe-snapshots
        ```

        2. **Identify public snapshots**:
           * Look for snapshots where the volume permissions include the "all" group.
        3. **Modify Snapshot Permissions**:

        ```bash theme={null}
        aws ec2 modify-snapshot-attribute --snapshot-id SNAPSHOT_ID --remove-group all
        ```

        Replace `SNAPSHOT_ID` with the identifier of the public snapshot.
        4\. **Repeat for other public snapshots**:

        * Repeat the modification command for all public snapshots identified.
      </Accordion>

      <Accordion title="Using Python">
        Here's a Python script to identify and remediate public EBS snapshots:

        ```python theme={null}
        import boto3

        class EBSSnapshotChecker:
            def __init__(self):
                self.ec2_client = boto3.client('ec2')

            def get_public_snapshots(self):
                failures = []
                response = self.ec2_client.describe_snapshots(OwnerIds=['self'])
                for snapshot in response['Snapshots']:
                    if self.is_snapshot_public(snapshot):
                        failures.append(snapshot)
                return failures

            def is_snapshot_public(self, snapshot):
                for permission in snapshot.get("Permissions", []):
                    if permission.get("Group", "") == "all":
                        return True
                return False

            def remediate_public_snapshot(self, snapshot_id):
                self.ec2_client.modify_snapshot_attribute(
                    SnapshotId=snapshot_id,
                    Attribute='createVolumePermission',
                    OperationType='remove',
                    GroupNames=['all']
                )
                print(f"Snapshot {snapshot_id} has been remediated.")

        # Instantiate the class
        checker = EBSSnapshotChecker()

        # Get public snapshots
        public_snapshots = checker.get_public_snapshots()

        # Remediate public snapshots
        for snapshot in public_snapshots:
            checker.remediate_public_snapshot(snapshot['SnapshotId'])
        ```

        This Python script identifies public EBS snapshots by checking if the permissions include the "all" group and then remediates them by removing the permission.

        Ensure to have appropriate IAM permissions for modifying EBS snapshots if you're using AWS CLI or Python script.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # EBS snapshot resource
        resource "aws_ebs_snapshot" "example" {
          snapshot_id = "SNAPSHOT_ID_TO_PROTECT" # replace with the snapshot ID or create from volume, etc.
          # ...other required arguments...
        }

        # REMOVE any resource like this that grants public access:
        # resource "aws_ebs_snapshot_create_volume_permission" "public" {
        #   snapshot_id = aws_ebs_snapshot.example.id
        #   group_names = ["all"] # this makes the snapshot public
        # }

        # If you manage sharing via Terraform and need to keep *account-level* sharing,
        # use aws_ebs_snapshot_create_volume_permission without the "all" group:
        resource "aws_ebs_snapshot_create_volume_permission" "shared_accounts" {
          snapshot_id = aws_ebs_snapshot.example.id

          # List only specific AWS account IDs that should retain access
          account_ids = [
            "SHARED_AWS_ACCOUNT_ID_1",
            "SHARED_AWS_ACCOUNT_ID_2",
          ]
        }
        ```

        This change mirrors `--operation-type remove --group-names all` by ensuring no `aws_ebs_snapshot_create_volume_permission` exists with `group_names = ["all"]`; it only alters permissions and does not replace the snapshot itself.

        To verify, `terraform plan` should show the `aws_ebs_snapshot_create_volume_permission` resource that had `group_names = ["all"]` being destroyed (or updated to remove `group_names = ["all"]`) with no replacement of the `aws_ebs_snapshot` resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://aws.amazon.com/premiumsupport/trustedadvisor/best-practices/](https://aws.amazon.com/premiumsupport/trustedadvisor/best-practices/)