Back to Checks
aws

Directory Service directory has adequate remaining manual snapshot quota

directoryservice_directory_snapshots_limit
Service: directoryserviceSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

AWS Directory Service directories with manual snapshot capacity fully consumed or nearly exhausted, based on current snapshot count relative to the directory's maximum allowed.

Prowler logoProwlerprowler-provider-aws

Risk

With no remaining snapshot capacity, you cannot create new recovery points:

  • Reduced availability during outages or ransomware
  • Higher RPO from failed scheduled backups
  • Greater change risk (schema/OS updates) without a safe rollback

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks directoryservice_directory_snapshots_limit

Recommendation

Adopt a snapshot lifecycle policy: rotate/expire old manual snapshots after verifying restores, and alert on low headroom. Prefer automated backups for cadence and retention. Enforce least privilege for snapshot creation. Design operations within the hard per-directory cap to prevent capacity exhaustion.

Remediation

Other

1In the AWS Console, go to Directory Service > Directories and open <example_resource_id>
2Click Snapshots
3Select older snapshots with Type = Manual and click Delete snapshot, confirm
4Repeat until the number of manual snapshots is less than (manual limit - 2). For the default limit of 5, keep at most 2 manual snapshots
5Verify Remaining manual snapshots > 2 on the Snapshots page

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.directoryservice.directoryservice_client import (
    directoryservice_client,
)

SNAPSHOT_LIMIT_THRESHOLD = 2
"""Number of remaining snapshots to reach the limit"""


class directoryservice_directory_snapshots_limit(Check):
    def execute(self):
        findings = []
        for directory in directoryservice_client.directories.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=directory)
            if directory.snapshots_limits:
                if directory.snapshots_limits.manual_snapshots_limit_reached:
                    report.status = "FAIL"
                    report.status_extended = f"Directory Service {directory.id} reached {directory.snapshots_limits.manual_snapshots_limit} Snapshots limit."
                else:
                    limit_remaining = (
                        directory.snapshots_limits.manual_snapshots_limit
                        - directory.snapshots_limits.manual_snapshots_current_count
                    )
                    if limit_remaining <= SNAPSHOT_LIMIT_THRESHOLD:
                        report.status = "FAIL"
                        report.status_extended = f"Directory Service {directory.id} is about to reach {directory.snapshots_limits.manual_snapshots_limit} Snapshots which is the limit."
                    else:
                        report.status = "PASS"
                        report.status_extended = f"Directory Service {directory.id} is using {directory.snapshots_limits.manual_snapshots_current_count} out of {directory.snapshots_limits.manual_snapshots_limit} from the Snapshots Limit."
                findings.append(report)

        return findings

References