Back to Checks
aws

EBS volume has at least one snapshot

ec2_ebs_volume_snapshots_exists
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:resilienceforensics-ready
Resource Type:AwsEc2Volume

EBS volumes are evaluated for the existence of at least one associated snapshot, identifying volumes without any point-in-time backup available.

Prowler logoProwlerprowler-provider-aws

Risk

Missing EBS snapshots removes point-in-time recovery. Accidental deletion, corruption, or ransomware can cause irrecoverable data loss and prolonged service outages, degrading data integrity and availability and complicating recovery and forensics.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_ebs_volume_snapshots_exists

Recommendation

Establish automated, policy-based EBS snapshot coverage for all volumes aligned to business RPO/RTO.

  • Schedule regular snapshots with retention controls
  • Encrypt snapshots and enforce least privilege access
  • Replicate to another Region/account for DR
  • Periodically test restores and document procedures

Remediation

CLI

aws ec2 create-snapshot --region <REGION> --volume-id <VOLUME_ID>

Terraform

# Create a snapshot for an existing EBS volume
resource "aws_ebs_snapshot" "<example_resource_name>" {
  volume_id = "<example_resource_id>" # Critical: creating this snapshot makes the volume pass the check
}

NativeIaC

# CloudFormation: create a snapshot of an existing EBS volume
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Snapshot
    Properties:
      VolumeId: <example_resource_id>  # Critical: creates a snapshot for this volume to pass the check

Other

1In the AWS Console, go to EC2
2Click Volumes, select the target EBS volume
3Choose Actions > Create snapshot
4Click Create snapshot to confirm

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_ebs_volume_snapshots_exists(Check):
    def execute(self):
        findings = []
        for volume in ec2_client.volumes:
            report = Check_Report_AWS(metadata=self.metadata(), resource=volume)
            report.status = "FAIL"
            report.status_extended = (
                f"Snapshots not found for the EBS volume {volume.id}."
            )
            if ec2_client.volumes_with_snapshots.get(volume.id, False):
                report.status = "PASS"
                report.status_extended = (
                    f"Snapshots found for the EBS volume {volume.id}."
                )
            findings.append(report)
        return findings

References