Cis AWS Compute 2.2.2

Ensure Public Access to EBS Snapshots is Disabled

Description

To protect your data disable the public mode of EBS snapshots.

Rationale

This protects your data so that it is not accessible to all AWS accounts preventing accidental access and leaks.

Impact

Removing public access from EBS snapshots may affect other AWS accounts that rely on them. Ensure private sharing is configured for any authorized accounts.

Audit Procedure

Using AWS CLI

1. For each snapshot, run:

aws ec2 describe-snapshot-attribute \
    --snapshot-id <snapshot-ID> \
    --attribute createVolumePermission

2. Validate Group is not set to all.

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane click Snapshots.
3. Select the snapshot then click Actions, Modify Permissions.
4. Confirm that the snapshot is set to Private.
5. Repeat for any additional Snapshots, Regions and AWS accounts.

If the snapshot is set to public refer to the remediation below.

Expected Result

The createVolumePermission attribute should not contain a Group set to "all". In the console, all snapshots should show as Private.

Remediation

Using AWS CLI

1. For each snapshot, run:

aws ec2 modify-snapshot-attribute \
    --snapshot-id <snapshot-ID> \
    --attribute createVolumePermission \
    --operation remove --group-name all

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane click Snapshots.
3. Select the snapshot then click 'Actions, Modify Permissions'.
4. Click the radio button for Private.
5. Click Save.
6. Repeat for any additional Snapshots, Regions and AWS accounts.

Default Value

By default, EBS snapshots are private when created.

References

1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html
2. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-snapshot-attribute.html

Additional Information

1. Snapshots are constrained to the Region in which they were created. To share a snapshot with another Region, copy the snapshot to that Region.
2. AWS prevents you from sharing snapshots that were encrypted with your default CMK. Snapshots that you intend to share must instead be encrypted with a customer managed CMK.
3. The public option is not valid for encrypted snapshots or snapshots with an AWS Marketplace product code.

CIS Controls

Profile

Level 1 | Automated