All checks
Critical
Amazon DocumentDB manual cluster snapshots should not be public
Checks whether a DocumentDB manual cluster snapshot is public, which lets any AWS account copy or restore its data. A copy made while it was public is beyond your reach, so treat the data as disclosed. DocumentDB, Neptune and RDS share one snapshot API, so a public Aurora or Neptune cluster snapshot is reported here too.
- service
- DocumentDB
- severity
- Critical
- scope
- evaluated in every region
How to fix it
- Affects another check: RDS.1 and Neptune.3 read the same restore attribute and report this snapshot too, so removing all clears their findings for it as well.
In the console
Amazon DocumentDB → Snapshots → the snapshot → Manage access
- DB snapshot visibility
- Private (accounts listed under AWS Account ID keep access and still pass)
With the AWS CLI
aws docdb modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier <snapshot-identifier> --attribute-name restore --values-to-remove all --region <region>See which of your accounts this check is failing on.
Book a live scan