1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
2. Navigate to the RDS Service: Click on the “Services” dropdown menu at the top of the page, then select “RDS” under the Database category.
3. Select the RDS Instance: In the RDS dashboard, locate and click on the RDS instance for which you want to secure the snapshots.
4. Access the Snapshots: In the RDS instance details page, find the “Snapshots” section in the left-hand menu and click on it.
5. Identify Public Snapshots: Look through the list of snapshots to identify any that are marked as public.
6. Modify Snapshot Permissions:
   • Click on the checkbox next to the public snapshot(s) that you want to secure.
   • Click on the “Modify Snapshot Permissions” button in the top menu.
   • In the “Modify Snapshot Permissions” window, uncheck the option that allows public access.
   • Click on the “Save Changes” button to apply the new permissions.
7. Verify Changes:
   • Review the list of snapshots again to ensure that the public snapshots are no longer accessible to the public.
8. Repeat if Necessary: If you have multiple RDS instances with public snapshots, repeat the above steps for each instance to secure all the snapshots.

​

1. List all the RDS database snapshots that are currently public:

aws rds describe-db-snapshot-attributes --db-snapshot-identifier <your-db-snapshot-identifier> --query "DBSnapshotAttributesResult.DBSnapshotAttributes[?AttributeName=='restore'].AttributeName" --output text

2. Modify the DB snapshot attribute to make it private:

aws rds modify-db-snapshot-attribute --db-snapshot-identifier <your-db-snapshot-identifier> --attribute-name restore --values-to-add all

3. Verify that the DB snapshot attribute has been updated successfully:

aws rds describe-db-snapshot-attributes --db-snapshot-identifier <your-db-snapshot-identifier> --query "DBSnapshotAttributesResult.DBSnapshotAttributes[?AttributeName=='restore'].AttributeName" --output text

1. Identify the Public Snapshots:
   • Use the AWS SDK for Python (Boto3) to list all the RDS database snapshots.
   • Filter out the snapshots that are marked as public.
2. Update Snapshot Permissions:
   • For each public snapshot identified, modify the snapshot attribute to make it private.
   • Use the modify_db_snapshot_attribute method from the Boto3 RDS client to update the snapshot attribute.
3. Sample Python Script: Here is a sample Python script that demonstrates how to identify and update public RDS database snapshots to private:
   import boto3
   
   # Initialize the RDS client
   rds_client = boto3.client('rds')
   
   # List all RDS snapshots
   response = rds_client.describe_db_snapshots()
   
   # Iterate through each snapshot
   for snapshot in response['DBSnapshots']:
       if snapshot['PubliclyAccessible']:
           # Update the snapshot attribute to make it private
           rds_client.modify_db_snapshot_attribute(
               DBSnapshotIdentifier=snapshot['DBSnapshotIdentifier'],
               AttributeName='restore',
               ValuesToRemove=['all'],
           )
           print(f"Snapshot {snapshot['DBSnapshotIdentifier']} is now private.")
   
4. Run the Script:
   • Save the script in a file (e.g., remediate_public_snapshots.py) and run it using Python.
   • Make sure you have the necessary IAM permissions to modify RDS snapshot attributes.