Back to Checks
aws

EBS snapshot is not public

ec2_ebs_public_snapshot
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Volume

EBS snapshots with public sharing permissions (accessible by all AWS accounts) are identified, as opposed to snapshots shared privately with specific accounts.

Prowler logoProwlerprowler-provider-aws

Risk

Public snapshots expose full volume contents, harming confidentiality. Any account can create a volume from the snapshot to read files, secrets, or database data, enabling data exfiltration, broad reconnaissance, and facilitating lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_ebs_public_snapshot

Recommendation

Keep snapshots private and share only with specific accounts under least privilege. Enable Block public access for Amazon EBS snapshots regionally. Prefer CMEK encryption and avoid sharing keys broadly. Regularly review sharing permissions and monitor snapshot usage.

Remediation

CLI

aws ec2 modify-snapshot-attribute --snapshot-id <EC2_SNAPSHOT_ID> --attribute createVolumePermission --operation-type remove --group-names all

Other

1Open the AWS Management Console and go to EC2
2In the left menu, select Snapshots
3Select the snapshot <EC2_SNAPSHOT_ID>
4Click Actions > Modify permissions
5Choose Private (remove Public/all if present)
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_ebs_public_snapshot(Check):
    def execute(self):
        findings = []
        for snapshot in ec2_client.snapshots:
            report = Check_Report_AWS(metadata=self.metadata(), resource=snapshot)
            report.status = "PASS"
            report.status_extended = f"EBS Snapshot {snapshot.id} is not Public."
            if snapshot.public:
                report.status = "FAIL"
                report.status_extended = (
                    f"EBS Snapshot {snapshot.id} is currently Public."
                )
            findings.append(report)

        return findings

References