All checks
Critical
Neptune DB cluster snapshots should not be public
Checks whether a Neptune manual DB cluster snapshot is public, which lets any AWS account copy or restore its data. A copy made while it was public is beyond your reach, so treat the data as disclosed. Neptune, DocumentDB and RDS share one snapshot API, so a public Aurora or DocumentDB cluster snapshot is reported here too.
- service
- Neptune
- severity
- Critical
- scope
- evaluated in every region
How to fix it
- Affects another check: RDS.1 and DocumentDB.3 read the same restore attribute and report this snapshot too, so removing all clears their findings for it as well.
In the console
Neptune → Snapshots → the snapshot → Manage snapshot sharing
- DB snapshot visibility
- Private (accounts listed under AWS Account ID keep access and still pass)
With the AWS CLI
aws neptune modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier <snapshot-identifier> --attribute-name restore --values-to-remove all --region <region>See which of your accounts this check is failing on.
Book a live scan