Back to Checks
aws

Lightsail instance has automated snapshots enabled

lightsail_instance_automated_snapshots
Service: lightsailSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Amazon Lightsail instances with automatic daily snapshots enabled are identified. The evaluation checks if an instance is configured to take recurring snapshots at a scheduled time.

Prowler logoProwlerprowler-provider-aws

Risk

Absent automation, data lacks point-in-time recovery, increasing availability risk from accidental deletion, corruption, or ransomware. Failed updates or compromise hinder quick rollback, degrading integrity and extending RPO/RTO, causing prolonged outages.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks lightsail_instance_automated_snapshots

Recommendation

Enable automatic snapshots on Lightsail instances and align the schedule with low-traffic windows. Apply least privilege to snapshot create/delete, and regularly test restores. Use defense in depth: retain multiple versions and replicate backups for critical workloads across regions or accounts.

Remediation

CLI

aws lightsail enable-add-on --region <REGION> --resource-name <example_resource_name> --add-on-request addOnType=AutoSnapshot

Terraform

# Enable automatic snapshots for a Lightsail instance
resource "aws_lightsail_instance" "<example_resource_name>" {
  name              = "<example_resource_name>"
  availability_zone = "<example_az>"
  blueprint_id      = "<example_blueprint_id>"
  bundle_id         = "<example_bundle_id>"

  add_on {
    type   = "AutoSnapshot"  # Critical: enables automatic snapshots
    status = "Enabled"       # Critical: turns the add-on on
  }
}

NativeIaC

# CloudFormation: Enable automatic snapshots for a Lightsail instance
Resources:
  <example_resource_name>:
    Type: AWS::Lightsail::Instance
    Properties:
      InstanceName: <example_resource_name>
      AvailabilityZone: <example_az>
      BlueprintId: <example_blueprint_id>
      BundleId: <example_bundle_id>
      AddOns:
        - AddOnType: AutoSnapshot  # Critical: enables automatic snapshots for the instance

Other

1Open the AWS Management Console and go to Lightsail
2Click Instances and select <example_resource_name>
3Open the Snapshots tab
4In Automatic snapshots, toggle On and confirm
5(Optional) Set a snapshot time if needed; otherwise the default time is used

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.lightsail.lightsail_client import lightsail_client


class lightsail_instance_automated_snapshots(Check):
    def execute(self):
        findings = []
        for instance in lightsail_client.instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "FAIL"
            report.status_extended = (
                f"Instance '{instance.name}' does not have automated snapshots enabled."
            )

            if instance.auto_snapshot:
                report.status = "PASS"
                report.status_extended = (
                    f"Instance '{instance.name}' has automated snapshots enabled."
                )

            findings.append(report)

        return findings

References