Back to Checks
aws

All EBS snapshots have public access blocked

ec2_ebs_snapshot_account_block_public_access
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Volume

EBS snapshots account/Region configuration for Block Public Access is assessed to see whether public sharing is fully blocked (block-all-sharing) versus only new sharing (block-new-sharing) or unblocked. The state indicates if any snapshot can be publicly shared.

Prowler logoProwlerprowler-provider-aws

Risk

Without block-all-sharing, previously public snapshots can remain accessible, exposing raw disk data.

Impacts:

  • Loss of confidentiality (PII, keys, configs)
  • Unauthorized cloning enabling lateral movement
  • Cross-account copies create irreversible data leakage

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_ebs_snapshot_account_block_public_access

Recommendation

Set Block Public Access for EBS snapshots to block-all-sharing in all active Regions.

Apply least privilege and guardrails (SCPs) to prevent changes. Regularly inventory snapshots, remove public sharing, and use segregated accounts with strict reviews for any necessary external sharing.

Remediation

CLI

aws ec2 enable-snapshot-block-public-access --state block-all-sharing

Terraform

resource "aws_ebs_snapshot_block_public_access" "<example_resource_name>" {
  state = "block-all-sharing" # CRITICAL: Blocks all public sharing of EBS snapshots in this Region
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::EC2::SnapshotBlockPublicAccess
    Properties:
      State: block-all-sharing  # CRITICAL: Blocks all public sharing of EBS snapshots in this Region to pass the check

Other

1In the AWS console, select the target Region in the top-right.
2Go to EC2 > Snapshots.
3Click Settings > Block public access for snapshots.
4Select Block all sharing.
5Click Save changes.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_ebs_snapshot_account_block_public_access(Check):
    def execute(self):
        findings = []
        for (
            ebs_snapshot_block_status
        ) in ec2_client.ebs_block_public_access_snapshots_states:
            if (
                ebs_snapshot_block_status.snapshots
                or ec2_client.provider.scan_unused_services
            ):
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=ebs_snapshot_block_status,
                )
                report.resource_arn = ec2_client.account_arn_template
                report.resource_id = ec2_client.audited_account
                if ebs_snapshot_block_status.status == "block-all-sharing":
                    report.status = "PASS"
                    report.status_extended = (
                        "Public access is blocked for all EBS Snapshots."
                    )
                elif ebs_snapshot_block_status.status == "block-new-sharing":
                    report.status = "FAIL"
                    report.status_extended = (
                        "Public access is blocked only for new EBS Snapshots."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        "Public access is not blocked for EBS Snapshots."
                    )
                findings.append(report)

        return findings

References