Ebs Snapshots Not Public Remediation

Triage and Remediation

Remediation

Remediation

Using Console

Sign in to the AWS Management Console.
Navigate to the EC2 service.
Select Snapshots from the navigation pane.
Identify public snapshots:
- Look for snapshots listed in the console that have permissions set to "all".
Select the public snapshot.
Modify Snapshot Permissions:
- Click on Actions > Modify Snapshot Permissions.
- Remove the "all" group permission if it exists.
- Add or modify permissions as necessary.
Repeat for other public snapshots:
- Repeat the above steps for all public snapshots identified.

Using CLI

List EBS Snapshots:

aws ec2 describe-snapshots

Identify public snapshots:
- Look for snapshots where the volume permissions include the "all" group.
Modify Snapshot Permissions:

aws ec2 modify-snapshot-attribute --snapshot-id SNAPSHOT_ID --remove-group all

Replace SNAPSHOT_ID with the identifier of the public snapshot. 4. Repeat for other public snapshots:

Repeat the modification command for all public snapshots identified.

Using Python

Here's a Python script to identify and remediate public EBS snapshots:

import boto3

class EBSSnapshotChecker:
    def __init__(self):
        self.ec2_client = boto3.client('ec2')

    def get_public_snapshots(self):
        failures = []
        response = self.ec2_client.describe_snapshots(OwnerIds=['self'])
        for snapshot in response['Snapshots']:
            if self.is_snapshot_public(snapshot):
                failures.append(snapshot)
        return failures

    def is_snapshot_public(self, snapshot):
        for permission in snapshot.get("Permissions", []):
            if permission.get("Group", "") == "all":
                return True
        return False

    def remediate_public_snapshot(self, snapshot_id):
        self.ec2_client.modify_snapshot_attribute(
            SnapshotId=snapshot_id,
            Attribute='createVolumePermission',
            OperationType='remove',
            GroupNames=['all']
        )
        print(f"Snapshot {snapshot_id} has been remediated.")

# Instantiate the class
checker = EBSSnapshotChecker()

# Get public snapshots
public_snapshots = checker.get_public_snapshots()

# Remediate public snapshots
for snapshot in public_snapshots:
    checker.remediate_public_snapshot(snapshot['SnapshotId'])

This Python script identifies public EBS snapshots by checking if the permissions include the "all" group and then remediates them by removing the permission.

Ensure to have appropriate IAM permissions for modifying EBS snapshots if you're using AWS CLI or Python script.

Using Terraform

# EBS snapshot resource
resource "aws_ebs_snapshot" "example" {
  snapshot_id = "SNAPSHOT_ID_TO_PROTECT" # replace with the snapshot ID or create from volume, etc.
  # ...other required arguments...
}

# REMOVE any resource like this that grants public access:
# resource "aws_ebs_snapshot_create_volume_permission" "public" {
#   snapshot_id = aws_ebs_snapshot.example.id
#   group_names = ["all"] # this makes the snapshot public
# }

# If you manage sharing via Terraform and need to keep *account-level* sharing,
# use aws_ebs_snapshot_create_volume_permission without the "all" group:
resource "aws_ebs_snapshot_create_volume_permission" "shared_accounts" {
  snapshot_id = aws_ebs_snapshot.example.id

  # List only specific AWS account IDs that should retain access
  account_ids = [
    "SHARED_AWS_ACCOUNT_ID_1",
    "SHARED_AWS_ACCOUNT_ID_2",
  ]
}

This change mirrors --operation-type remove --group-names all by ensuring no aws_ebs_snapshot_create_volume_permission exists with group_names = ["all"]; it only alters permissions and does not replace the snapshot itself.

To verify, terraform plan should show the aws_ebs_snapshot_create_volume_permission resource that had group_names = ["all"] being destroyed (or updated to remove group_names = ["all"]) with no replacement of the aws_ebs_snapshot resource.

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation