All checks
Critical
EBS snapshots should not be configured to be publicly restorable
Checks whether an EBS snapshot's createVolumePermission grants the all group, which lets any AWS account create a volume holding all of the snapshot's data. A volume created while it was public is beyond your reach, so treat the data as disclosed.
- service
- EC2
- severity
- Critical
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Snapshots → the snapshot → Actions → Modify permissions
- Private
- Selected (accounts listed under Sharing accounts keep access and still pass)
With the AWS CLI
aws ec2 modify-snapshot-attribute --snapshot-id <snapshot-id> --attribute createVolumePermission --operation-type remove --group-names allSee which of your accounts this check is failing on.
Book a live scan