Back to Checks
aws

NeptuneDB cluster snapshot is not publicly shared

neptune_cluster_public_snapshot
Service: neptuneSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsRdsDbClusterSnapshot

Neptune DB manual cluster snapshot is evaluated to determine if its restore attributes allow access to all AWS accounts (public).

A failed status in the report means the snapshot is publicly shared and can be copied or restored by any AWS account; PASS means it is not shared publicly.

Prowler logoProwlerprowler-provider-aws

Risk

Public snapshots compromise confidentiality of stored data and metadata.

Attackers or third parties can:

  • Copy or restore snapshots to external accounts.
  • Access sensitive data contained in the snapshot.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks neptune_cluster_public_snapshot

Recommendation

Avoid public sharing and apply least privilege when granting snapshot access: share only with specific AWS accounts or roles.

Use encryption, enforce automated policies and regular audits, and apply separation of duties and tagging to control and track snapshot access.

Remediation

CLI

aws neptune modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier <snapshot_id> --attribute-name restore --values-to-remove all

Other

1Sign in to the AWS Management Console and open the Amazon RDS console
2In the left navigation, choose Snapshots > DB cluster snapshots
3Select the snapshot, choose Actions > Manage snapshot permissions
4In the permissions dialog remove the Public/all-accounts permission and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.neptune.neptune_client import neptune_client


class neptune_cluster_public_snapshot(Check):
    def execute(self):
        findings = []
        for db_snap in neptune_client.db_cluster_snapshots:
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_snap)
            if db_snap.public:
                report.status = "FAIL"
                report.status_extended = (
                    f"NeptuneDB Cluster Snapshot {db_snap.id} is public."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"NeptuneDB Cluster Snapshot {db_snap.id} is not shared publicly."
                )

            findings.append(report)

        return findings

References