Neptune DB Cluster Snapshot Should Not Be Public

More Info:

Checks if an Amazon Neptune manual DB cluster snapshot is public. The rule is NON_COMPLIANT if any existing and new Neptune cluster snapshot is public.

Risk Level

Medium

Address

Security

Compliance Standards

CBP,SEBI

Triage and Remediation

Remediation

Using Console

Using CLI

Follow these steps to modify the snapshot permissions using AWS CLI:

List Public Snapshots: Run the following AWS CLI command to identify any public Neptune DB cluster snapshots:

aws neptune describe-db-cluster-snapshots --query "DBClusterSnapshots[?PubliclyAccessible=='true']"

Update Snapshot Permissions: Modify the snapshot’s attributes to disable public access using the following command:

aws neptune modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier <snapshot-identifier> --attribute-name "restore" --values-to-remove "all"

Replace <snapshot-identifier> with the actual ID of the public snapshot you wish to modify.

Verify Changes: Run the describe-db-cluster-snapshots command again to ensure that the snapshot is no longer public:

aws neptune describe-db-cluster-snapshots --query "DBClusterSnapshots[?PubliclyAccessible=='true']"

Using Python

To remediate the issue of public Neptune DB Cluster Snapshots programmatically using Python, follow these steps:

Identify Public Snapshots: Use the AWS SDK for Python (Boto3) to identify any public Neptune DB cluster snapshots:

import boto3

client = boto3.client('neptune')

response = client.describe_db_cluster_snapshots()

for snapshot in response['DBClusterSnapshots']:
    if snapshot['PubliclyAccessible']:
        print(f"Public snapshot: {snapshot['DBClusterSnapshotIdentifier']}")

Modify Snapshot Permissions: For each identified public snapshot, modify its permissions to remove public access:

for snapshot in response['DBClusterSnapshots']:
    if snapshot['PubliclyAccessible']:
        client.modify_db_cluster_snapshot_attribute(
            DBClusterSnapshotIdentifier=snapshot['DBClusterSnapshotIdentifier'],
            AttributeName='restore',
            ValuesToRemove=['all']
        )
        print(f"Snapshot {snapshot['DBClusterSnapshotIdentifier']} is now private.")

Re-Verify: After making the changes, re-run the script to confirm that no public snapshots remain:

response = client.describe_db_cluster_snapshots()

public_snapshots = [snapshot for snapshot in response['DBClusterSnapshots'] if snapshot['PubliclyAccessible']]

if not public_snapshots:
    print("No public snapshots found.")
else:
    print("Some snapshots are still public.")

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Neptune DB Cluster Snapshot Should Not Be Public

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation