Neptune DB Cluster Snapshot Should Not Be Public

More Info:

Checks if an Amazon Neptune manual DB cluster snapshot is public. The rule is NON_COMPLIANT if any existing and new Neptune cluster snapshot is public.

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Startup Security Baseline
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To fix a public Neptune DB cluster snapshot (or RDS snapshot) using the AWS Management Console, you need to remove the “public” sharing setting and restrict it to specific AWS accounts (or keep it private).

Step 1: Open the Neptune (or RDS) Console

Sign in to the AWS Management Console.
Go to:
- For Neptune: Services → Neptune
- For RDS: Services → RDS

(The steps are almost identical; use the service where the snapshot lives.)

Step 2: Locate the Public Snapshot

In the left navigation pane:
- Neptune: click Snapshots
- RDS: click Snapshots
In the Snapshots list:
- Use the Filter dropdown to select Cluster snapshots (for Neptune) or the relevant snapshot type.
- Look for snapshots with Type = Manual or Automated as needed.
Identify snapshots that are public:
- For RDS: a snapshot is public if "Public" column shows Yes.
- For Neptune: check the "Public"/"Shared" indicator or check its attributes in the next step.

Step 3: View and Edit Snapshot Permissions

Select the snapshot you want to fix (check the box next to it).
Choose Actions → Share snapshot (Neptune/RDS wording is similar, may be “Share” or “Modify snapshot permissions”).
A panel opens showing:
- Whether the snapshot is Public
- A list of AWS account IDs the snapshot is shared with (if any)

Step 4: Remove Public Access

In the Snapshot visibility or Public access section:
- If there is a checkbox or toggle such as “Public”, “Make snapshot public”, or “Share snapshot publicly”, clear/disable it.
Verify that:
- The snapshot is not marked as public.
- No option indicates “accessible by all AWS accounts”.

If you need the snapshot to remain shared with specific accounts:

Leave “Public” turned off.
In “Add AWS account ID”, enter only the specific AWS Account IDs you trust and click Add.

Step 5: Save Changes

Click Save, Modify, or Share (button name varies).
Wait a few moments for the changes to apply.

Step 6: Confirm It’s No Longer Public

Back in the Snapshots list:
- Confirm that the Public column for that snapshot is now No (for RDS), or that the visibility/permissions show not public for Neptune.
If applicable, try using Describe or Details to verify that the snapshot is only shared with specific account IDs or is private.

Repeat these steps for any other snapshots that are currently public.

Using CLI

To ensure Neptune (or RDS) DB cluster snapshots are not public using the AWS CLI, you need to remove the all value from the restore attribute on each snapshot.

Below are step‑by‑step commands.

1. List all DB cluster snapshots

aws rds describe-db-cluster-snapshots \
  --query "DBClusterSnapshots[].DBClusterSnapshotIdentifier" \
  --output text

If you only want manual snapshots:

aws rds describe-db-cluster-snapshots \
  --snapshot-type manual \
  --query "DBClusterSnapshots[].DBClusterSnapshotIdentifier" \
  --output text

Note/copy the snapshot identifiers you want to check or fix.

2. Check if a cluster snapshot is public

Run for each snapshot:

SNAPSHOT_ID="your-cluster-snapshot-id"

aws rds describe-db-cluster-snapshot-attributes \
  --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
  --query "DBClusterSnapshotAttributesResult.DBClusterSnapshotAttributes"

If you see:

[
  {
    "AttributeName": "restore",
    "AttributeValues": ["all", "123456789012", ...]
  }
]

then the snapshot is public (because all is present).

3. Make the snapshot private (remove public access)

Remove all from the restore attribute:

SNAPSHOT_ID="your-cluster-snapshot-id"

aws rds modify-db-cluster-snapshot-attribute \
  --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
  --attribute-name restore \
  --values-to-remove all

This keeps any specific AWS account IDs that are listed but removes public access.

4. Verify the snapshot is no longer public

aws rds describe-db-cluster-snapshot-attributes \
  --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
  --query "DBClusterSnapshotAttributesResult.DBClusterSnapshotAttributes"

Ensure AttributeValues does not contain "all".

5. (Optional) Bulk remediation for all public cluster snapshots

You can use a small shell loop (bash):

# Get all manual cluster snapshots
for SNAPSHOT_ID in $(aws rds describe-db-cluster-snapshots \
    --snapshot-type manual \
    --query "DBClusterSnapshots[].DBClusterSnapshotIdentifier" \
    --output text); do

  # Check if snapshot is public
  IS_PUBLIC=$(aws rds describe-db-cluster-snapshot-attributes \
    --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
    --query "DBClusterSnapshotAttributesResult.DBClusterSnapshotAttributes[?AttributeName=='restore'].AttributeValues[]" \
    --output text | tr '\t' '\n' | grep -x "all" || true)

  if [ "$IS_PUBLIC" == "all" ]; then
    echo "Making snapshot private: $SNAPSHOT_ID"
    aws rds modify-db-cluster-snapshot-attribute \
      --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
      --attribute-name restore \
      --values-to-remove all
  fi
done

This will automatically remove public access from all public manual DB cluster snapshots.

Using Python

Below is a Python/boto3 approach to detect and fix public Neptune DB cluster snapshots (i.e., snapshots whose restore permissions include all).

Note: This is for Amazon Neptune cluster snapshots (different from standard RDS engines), but the API is under the same rds/Neptune family in boto3 via client = boto3.client("neptune").

1. Prerequisites

Python 3.x
boto3 installed:
```
pip install boto3
```
AWS credentials configured with permissions:
- neptune:DescribeDBClusterSnapshots
- neptune:DescribeDBClusterSnapshotAttributes
- neptune:ModifyDBClusterSnapshotAttribute

2. Logic

List all Neptune DB cluster snapshots.
For each snapshot, retrieve its restore attributes.
If all is present in the AttributeValues for the restore attribute, the snapshot is public.
Remove all from restore permissions using ModifyDBClusterSnapshotAttribute.

3. Python Script to Identify and Fix Public Snapshots

import boto3

# If using a specific region:
# client = boto3.client("neptune", region_name="us-east-1")
client = boto3.client("neptune")

def get_all_neptune_cluster_snapshots():
    """Return all DB cluster snapshots (manual + automated) for Neptune."""
    snapshots = []
    paginator = client.get_paginator("describe_db_cluster_snapshots")
    for page in paginator.paginate():
        snapshots.extend(page.get("DBClusterSnapshots", []))
    return snapshots

def is_snapshot_public(snapshot_id):
    """Check if a Neptune DB cluster snapshot is public (restore permission has 'all')."""
    resp = client.describe_db_cluster_snapshot_attributes(
        DBClusterSnapshotIdentifier=snapshot_id
    )
    attrs = resp["DBClusterSnapshotAttributesResult"]["DBClusterSnapshotAttributes"]
    for attr in attrs:
        if attr["AttributeName"] == "restore":
            # If 'all' is in AttributeValues, snapshot is public
            return "all" in attr.get("AttributeValues", [])
    return False

def make_snapshot_private(snapshot_id):
    """Remove 'all' from restore permissions for the given snapshot."""
    print(f"Making snapshot private: {snapshot_id}")
    client.modify_db_cluster_snapshot_attribute(
        DBClusterSnapshotIdentifier=snapshot_id,
        AttributeName="restore",
        ValuesToRemove=["all"]
    )

def remediate_public_neptune_snapshots(dry_run=True):
    snapshots = get_all_neptune_cluster_snapshots()
    print(f"Found {len(snapshots)} Neptune DB cluster snapshots")

    for snap in snapshots:
        snapshot_id = snap["DBClusterSnapshotIdentifier"]
        # Optional filter: only manual snapshots, for safety
        # if snap["SnapshotType"] != "manual":
        #     continue

        try:
            if is_snapshot_public(snapshot_id):
                if dry_run:
                    print(f"[DRY RUN] Snapshot is PUBLIC and would be fixed: {snapshot_id}")
                else:
                    make_snapshot_private(snapshot_id)
            else:
                print(f"Snapshot is not public: {snapshot_id}")
        except client.exceptions.DBClusterSnapshotNotFoundFault:
            print(f"Snapshot not found (skipping): {snapshot_id}")
        except Exception as e:
            print(f"Error processing {snapshot_id}: {e}")

if __name__ == "__main__":
    # First run in dry-run mode to see what would change
    remediate_public_neptune_snapshots(dry_run=True)

    # After reviewing output, run without dry_run to actually fix
    # remediate_public_neptune_snapshots(dry_run=False)

4. Steps to Use

Save the script as fix_neptune_public_snapshots.py.
Run a dry run:
```
python fix_neptune_public_snapshots.py
```
Confirm the list of snapshots marked as “PUBLIC and would be fixed”.
Uncomment the last line and run with dry_run=False to actually remove public access:
```
python fix_neptune_public_snapshots.py
```

This will ensure all Neptune DB cluster snapshots in the selected region no longer have all in their restore attribute, making them private.

Using Terraform

# This remediation (removing the "all" restore permission from a Neptune DB
# cluster snapshot) is not currently exposed in the AWS Terraform provider.
# There is no Terraform resource/argument to manage Neptune DB cluster
# snapshot attributes/permissions (the equivalent of the CLI
# modify-db-cluster-snapshot-attribute call).

# You must remediate this outside Terraform using the AWS CLI or Console,
# for each affected snapshot:

# CLI (matches the verified remediation):
#   aws neptune modify-db-cluster-snapshot-attribute \
#     --db-cluster-snapshot-identifier YOUR_SNAPSHOT_IDENTIFIER \
#     --attribute-name restore \
#     --values-to-remove '["all"]' \
#     --region YOUR_REGION

# Console:
# - Open Amazon Neptune in the AWS Console.
# - Go to "Snapshots" → "DB cluster snapshots".
# - Select the manual snapshot.
# - Choose "Share snapshot" or "Modify" permissions.
# - Remove the "public" / "All AWS accounts" entry and save.

# WARNING: This makes the snapshot private by revoking public restore
# permissions and cannot be represented or enforced directly in Terraform yet.

# Verification in Terraform:
# `terraform plan` will show NO changes related to snapshot permissions,
# because they are not managed by the provider.

Additional Reading:

https://docs.aws.amazon.com/config/latest/developerguide/neptune-cluster-snapshot-public-prohibited.html

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Step 1: Open the Neptune (or RDS) Console​

Step 2: Locate the Public Snapshot​

Step 3: View and Edit Snapshot Permissions​

Step 4: Remove Public Access​

Step 5: Save Changes​

Step 6: Confirm It’s No Longer Public​

1. List all DB cluster snapshots​

2. Check if a cluster snapshot is public​

3. Make the snapshot private (remove public access)​

4. Verify the snapshot is no longer public​

5. (Optional) Bulk remediation for all public cluster snapshots​

1. Prerequisites​

2. Logic​

3. Python Script to Identify and Fix Public Snapshots​

4. Steps to Use​

Additional Reading:​