> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Neptune cluster snapshot public prohibited remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To fix a **public Neptune DB cluster snapshot** (or RDS snapshot) using the **AWS Management Console**, you need to remove the “public” sharing setting and restrict it to specific AWS accounts (or keep it private).

        ### Step 1: Open the Neptune (or RDS) Console

        1. Sign in to the **AWS Management Console**.
        2. Go to:
           * For Neptune: **Services → Neptune**
           * For RDS: **Services → RDS**

        *(The steps are almost identical; use the service where the snapshot lives.)*

        ***

        ### Step 2: Locate the Public Snapshot

        1. In the left navigation pane:
           * Neptune: click **Snapshots**
           * RDS: click **Snapshots**
        2. In the Snapshots list:
           * Use the **Filter** dropdown to select **Cluster snapshots** (for Neptune) or the relevant snapshot type.
           * Look for snapshots with **Type** = *Manual* or *Automated* as needed.
        3. Identify snapshots that are **public**:
           * For RDS: a snapshot is public if **"Public"** column shows **Yes**.
           * For Neptune: check the **"Public"**/**"Shared"** indicator or check its attributes in the next step.

        ***

        ### Step 3: View and Edit Snapshot Permissions

        1. Select the snapshot you want to fix (check the box next to it).
        2. Choose **Actions → Share snapshot** (Neptune/RDS wording is similar, may be “Share” or “Modify snapshot permissions”).
        3. A panel opens showing:
           * Whether the snapshot is **Public**
           * A list of **AWS account IDs** the snapshot is shared with (if any)

        ***

        ### Step 4: Remove Public Access

        1. In the **Snapshot visibility** or **Public access** section:
           * If there is a checkbox or toggle such as **“Public”**, **“Make snapshot public”**, or **“Share snapshot publicly”**, **clear/disable** it.
        2. Verify that:
           * The snapshot is **not** marked as public.
           * No option indicates “accessible by all AWS accounts”.

        If you need the snapshot to remain shared with specific accounts:

        * Leave **“Public”** turned off.
        * In “Add AWS account ID”, enter only the specific **AWS Account IDs** you trust and click **Add**.

        ***

        ### Step 5: Save Changes

        1. Click **Save**, **Modify**, or **Share** (button name varies).
        2. Wait a few moments for the changes to apply.

        ***

        ### Step 6: Confirm It’s No Longer Public

        1. Back in the **Snapshots** list:
           * Confirm that the **Public** column for that snapshot is now **No** (for RDS), or that the visibility/permissions show **not public** for Neptune.
        2. If applicable, try using **Describe** or **Details** to verify that the snapshot is only shared with specific account IDs or is private.

        Repeat these steps for any other snapshots that are currently public.
      </Accordion>

      <Accordion title="Using CLI">
        To ensure Neptune (or RDS) **DB cluster snapshots are not public** using the AWS CLI, you need to remove the `all` value from the `restore` attribute on each snapshot.

        Below are step‑by‑step commands.

        ***

        ### 1. List all DB cluster snapshots

        ```bash theme={null}
        aws rds describe-db-cluster-snapshots \
          --query "DBClusterSnapshots[].DBClusterSnapshotIdentifier" \
          --output text
        ```

        If you only want manual snapshots:

        ```bash theme={null}
        aws rds describe-db-cluster-snapshots \
          --snapshot-type manual \
          --query "DBClusterSnapshots[].DBClusterSnapshotIdentifier" \
          --output text
        ```

        Note/copy the snapshot identifiers you want to check or fix.

        ***

        ### 2. Check if a cluster snapshot is public

        Run for each snapshot:

        ```bash theme={null}
        SNAPSHOT_ID="your-cluster-snapshot-id"

        aws rds describe-db-cluster-snapshot-attributes \
          --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
          --query "DBClusterSnapshotAttributesResult.DBClusterSnapshotAttributes"
        ```

        If you see:

        ```json theme={null}
        [
          {
            "AttributeName": "restore",
            "AttributeValues": ["all", "123456789012", ...]
          }
        ]
        ```

        then the snapshot is public (because `all` is present).

        ***

        ### 3. Make the snapshot private (remove public access)

        Remove `all` from the `restore` attribute:

        ```bash theme={null}
        SNAPSHOT_ID="your-cluster-snapshot-id"

        aws rds modify-db-cluster-snapshot-attribute \
          --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
          --attribute-name restore \
          --values-to-remove all
        ```

        This keeps any specific AWS account IDs that are listed but removes public access.

        ***

        ### 4. Verify the snapshot is no longer public

        ```bash theme={null}
        aws rds describe-db-cluster-snapshot-attributes \
          --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
          --query "DBClusterSnapshotAttributesResult.DBClusterSnapshotAttributes"
        ```

        Ensure `AttributeValues` does **not** contain `"all"`.

        ***

        ### 5. (Optional) Bulk remediation for all public cluster snapshots

        You can use a small shell loop (bash):

        ```bash theme={null}
        # Get all manual cluster snapshots
        for SNAPSHOT_ID in $(aws rds describe-db-cluster-snapshots \
            --snapshot-type manual \
            --query "DBClusterSnapshots[].DBClusterSnapshotIdentifier" \
            --output text); do

          # Check if snapshot is public
          IS_PUBLIC=$(aws rds describe-db-cluster-snapshot-attributes \
            --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
            --query "DBClusterSnapshotAttributesResult.DBClusterSnapshotAttributes[?AttributeName=='restore'].AttributeValues[]" \
            --output text | tr '\t' '\n' | grep -x "all" || true)

          if [ "$IS_PUBLIC" == "all" ]; then
            echo "Making snapshot private: $SNAPSHOT_ID"
            aws rds modify-db-cluster-snapshot-attribute \
              --db-cluster-snapshot-identifier "$SNAPSHOT_ID" \
              --attribute-name restore \
              --values-to-remove all
          fi
        done
        ```

        This will automatically remove public access from all public manual DB cluster snapshots.
      </Accordion>

      <Accordion title="Using Python">
        Below is a Python/boto3 approach to detect and fix **public Neptune DB cluster snapshots** (i.e., snapshots whose restore permissions include `all`).

        > Note: This is for **Amazon Neptune** cluster snapshots (different from standard RDS engines), but the API is under the same `rds`/Neptune family in boto3 via `client = boto3.client("neptune")`.

        ***

        ## 1. Prerequisites

        * Python 3.x
        * `boto3` installed:
          ```bash theme={null}
          pip install boto3
          ```
        * AWS credentials configured with permissions:
          * `neptune:DescribeDBClusterSnapshots`
          * `neptune:DescribeDBClusterSnapshotAttributes`
          * `neptune:ModifyDBClusterSnapshotAttribute`

        ***

        ## 2. Logic

        1. List all Neptune **DB cluster snapshots**.
        2. For each snapshot, retrieve its **restore** attributes.
        3. If `all` is present in the `AttributeValues` for the `restore` attribute, the snapshot is public.
        4. Remove `all` from restore permissions using `ModifyDBClusterSnapshotAttribute`.

        ***

        ## 3. Python Script to Identify and Fix Public Snapshots

        ```python theme={null}
        import boto3

        # If using a specific region:
        # client = boto3.client("neptune", region_name="us-east-1")
        client = boto3.client("neptune")

        def get_all_neptune_cluster_snapshots():
            """Return all DB cluster snapshots (manual + automated) for Neptune."""
            snapshots = []
            paginator = client.get_paginator("describe_db_cluster_snapshots")
            for page in paginator.paginate():
                snapshots.extend(page.get("DBClusterSnapshots", []))
            return snapshots

        def is_snapshot_public(snapshot_id):
            """Check if a Neptune DB cluster snapshot is public (restore permission has 'all')."""
            resp = client.describe_db_cluster_snapshot_attributes(
                DBClusterSnapshotIdentifier=snapshot_id
            )
            attrs = resp["DBClusterSnapshotAttributesResult"]["DBClusterSnapshotAttributes"]
            for attr in attrs:
                if attr["AttributeName"] == "restore":
                    # If 'all' is in AttributeValues, snapshot is public
                    return "all" in attr.get("AttributeValues", [])
            return False

        def make_snapshot_private(snapshot_id):
            """Remove 'all' from restore permissions for the given snapshot."""
            print(f"Making snapshot private: {snapshot_id}")
            client.modify_db_cluster_snapshot_attribute(
                DBClusterSnapshotIdentifier=snapshot_id,
                AttributeName="restore",
                ValuesToRemove=["all"]
            )

        def remediate_public_neptune_snapshots(dry_run=True):
            snapshots = get_all_neptune_cluster_snapshots()
            print(f"Found {len(snapshots)} Neptune DB cluster snapshots")

            for snap in snapshots:
                snapshot_id = snap["DBClusterSnapshotIdentifier"]
                # Optional filter: only manual snapshots, for safety
                # if snap["SnapshotType"] != "manual":
                #     continue

                try:
                    if is_snapshot_public(snapshot_id):
                        if dry_run:
                            print(f"[DRY RUN] Snapshot is PUBLIC and would be fixed: {snapshot_id}")
                        else:
                            make_snapshot_private(snapshot_id)
                    else:
                        print(f"Snapshot is not public: {snapshot_id}")
                except client.exceptions.DBClusterSnapshotNotFoundFault:
                    print(f"Snapshot not found (skipping): {snapshot_id}")
                except Exception as e:
                    print(f"Error processing {snapshot_id}: {e}")

        if __name__ == "__main__":
            # First run in dry-run mode to see what would change
            remediate_public_neptune_snapshots(dry_run=True)

            # After reviewing output, run without dry_run to actually fix
            # remediate_public_neptune_snapshots(dry_run=False)
        ```

        ***

        ## 4. Steps to Use

        1. Save the script as `fix_neptune_public_snapshots.py`.
        2. Run a **dry run**:
           ```bash theme={null}
           python fix_neptune_public_snapshots.py
           ```
        3. Confirm the list of snapshots marked as “PUBLIC and would be fixed”.
        4. Uncomment the last line and run with `dry_run=False` to actually remove public access:
           ```bash theme={null}
           python fix_neptune_public_snapshots.py
           ```

        This will ensure all Neptune DB cluster snapshots in the selected region no longer have `all` in their `restore` attribute, making them private.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # This remediation (removing the "all" restore permission from a Neptune DB
        # cluster snapshot) is not currently exposed in the AWS Terraform provider.
        # There is no Terraform resource/argument to manage Neptune DB cluster
        # snapshot attributes/permissions (the equivalent of the CLI
        # modify-db-cluster-snapshot-attribute call).

        # You must remediate this outside Terraform using the AWS CLI or Console,
        # for each affected snapshot:

        # CLI (matches the verified remediation):
        #   aws neptune modify-db-cluster-snapshot-attribute \
        #     --db-cluster-snapshot-identifier YOUR_SNAPSHOT_IDENTIFIER \
        #     --attribute-name restore \
        #     --values-to-remove '["all"]' \
        #     --region YOUR_REGION

        # Console:
        # - Open Amazon Neptune in the AWS Console.
        # - Go to "Snapshots" → "DB cluster snapshots".
        # - Select the manual snapshot.
        # - Choose "Share snapshot" or "Modify" permissions.
        # - Remove the "public" / "All AWS accounts" entry and save.

        # WARNING: This makes the snapshot private by revoking public restore
        # permissions and cannot be represented or enforced directly in Terraform yet.

        # Verification in Terraform:
        # `terraform plan` will show NO changes related to snapshot permissions,
        # because they are not managed by the provider.
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>