Back to Checks
aws

DocumentDB manual cluster snapshot is not shared publicly

documentdb_cluster_public_snapshot
Service: documentdbSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsRdsDbClusterSnapshot

Amazon DocumentDB manual cluster snapshot visibility is evaluated to detect snapshots marked as public instead of limited to specified AWS accounts.

Prowler logoProwlerprowler-provider-aws

Risk

Public snapshots weaken confidentiality: any AWS account can restore and read database contents, enabling data exfiltration.

They also aid lateral movement by revealing embedded secrets/config and reduce accountability when restores occur outside your account.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks documentdb_cluster_public_snapshot

Recommendation

Keep snapshot visibility Private and share only with trusted accounts under least privilege. Prefer CMEK encryption to enforce key-based access and prevent public sharing. Periodically review sharing lists, restrict IAM permissions that alter visibility, and monitor for exposure as defense in depth.

Remediation

CLI

aws docdb modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier <snapshot_id> --attribute-name restore --values-to-remove all

Other

1Open the Amazon DocumentDB console and go to Snapshots
2Select the public manual cluster snapshot
3Click Actions > Share
4Set DB snapshot visibility to Private (remove "all" if listed)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.documentdb.documentdb_client import (
    documentdb_client,
)


class documentdb_cluster_public_snapshot(Check):
    def execute(self):
        findings = []
        for db_snap in documentdb_client.db_cluster_snapshots:
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_snap)
            if db_snap.public:
                report.status = "FAIL"
                report.status_extended = (
                    f"DocumentDB Cluster Snapshot {db_snap.id} is public."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"DocumentDB Cluster Snapshot {db_snap.id} is not shared publicly."
                )

            findings.append(report)

        return findings

References