> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ebs snapshots not public remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        1. **Sign in to the AWS Management Console**.
        2. **Navigate to the EC2 service**.
        3. **Select Snapshots from the navigation pane**.
        4. **Identify public snapshots**:
           * Look for snapshots listed in the console that have permissions set to "all".
        5. **Select the public snapshot**.
        6. **Modify Snapshot Permissions**:
           * Click on Actions > Modify Snapshot Permissions.
           * Remove the "all" group permission if it exists.
           * Add or modify permissions as necessary.
        7. **Repeat for other public snapshots**:
           * Repeat the above steps for all public snapshots identified.

        #
      </Accordion>

      <Accordion title="Using CLI">
        1. **List EBS Snapshots**:

        ```bash theme={null}
        aws ec2 describe-snapshots
        ```

        2. **Identify public snapshots**:
           * Look for snapshots where the volume permissions include the "all" group.
        3. **Modify Snapshot Permissions**:

        ```bash theme={null}
        aws ec2 modify-snapshot-attribute --snapshot-id SNAPSHOT_ID --remove-group all
        ```

        Replace `SNAPSHOT_ID` with the identifier of the public snapshot.
        4\. **Repeat for other public snapshots**:

        * Repeat the modification command for all public snapshots identified.
      </Accordion>

      <Accordion title="Using Python">
        Here's a Python script to identify and remediate public EBS snapshots:

        ```python theme={null}
        import boto3

        class EBSSnapshotChecker:
            def __init__(self):
                self.ec2_client = boto3.client('ec2')

            def get_public_snapshots(self):
                failures = []
                response = self.ec2_client.describe_snapshots(OwnerIds=['self'])
                for snapshot in response['Snapshots']:
                    if self.is_snapshot_public(snapshot):
                        failures.append(snapshot)
                return failures

            def is_snapshot_public(self, snapshot):
                for permission in snapshot.get("Permissions", []):
                    if permission.get("Group", "") == "all":
                        return True
                return False

            def remediate_public_snapshot(self, snapshot_id):
                self.ec2_client.modify_snapshot_attribute(
                    SnapshotId=snapshot_id,
                    Attribute='createVolumePermission',
                    OperationType='remove',
                    GroupNames=['all']
                )
                print(f"Snapshot {snapshot_id} has been remediated.")

        # Instantiate the class
        checker = EBSSnapshotChecker()

        # Get public snapshots
        public_snapshots = checker.get_public_snapshots()

        # Remediate public snapshots
        for snapshot in public_snapshots:
            checker.remediate_public_snapshot(snapshot['SnapshotId'])
        ```

        This Python script identifies public EBS snapshots by checking if the permissions include the "all" group and then remediates them by removing the permission.

        Ensure to have appropriate IAM permissions for modifying EBS snapshots if you're using AWS CLI or Python script.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # EBS snapshot resource
        resource "aws_ebs_snapshot" "example" {
          snapshot_id = "SNAPSHOT_ID_TO_PROTECT" # replace with the snapshot ID or create from volume, etc.
          # ...other required arguments...
        }

        # REMOVE any resource like this that grants public access:
        # resource "aws_ebs_snapshot_create_volume_permission" "public" {
        #   snapshot_id = aws_ebs_snapshot.example.id
        #   group_names = ["all"] # this makes the snapshot public
        # }

        # If you manage sharing via Terraform and need to keep *account-level* sharing,
        # use aws_ebs_snapshot_create_volume_permission without the "all" group:
        resource "aws_ebs_snapshot_create_volume_permission" "shared_accounts" {
          snapshot_id = aws_ebs_snapshot.example.id

          # List only specific AWS account IDs that should retain access
          account_ids = [
            "SHARED_AWS_ACCOUNT_ID_1",
            "SHARED_AWS_ACCOUNT_ID_2",
          ]
        }
        ```

        This change mirrors `--operation-type remove --group-names all` by ensuring no `aws_ebs_snapshot_create_volume_permission` exists with `group_names = ["all"]`; it only alters permissions and does not replace the snapshot itself.

        To verify, `terraform plan` should show the `aws_ebs_snapshot_create_volume_permission` resource that had `group_names = ["all"]` being destroyed (or updated to remove `group_names = ["all"]`) with no replacement of the `aws_ebs_snapshot` resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>