Résumé
ONYEDIKACHI BERNARDCLOUD · DEVSECOPS · AI
RésuméGet in touch
CASE 15STORAGE & DATA

Public EBS Snapshot Remediation

A snapshot tagged as sensitive was unencrypted and shared with every AWS account. I removed the public permission and created an encrypted copy with a customer-managed KMS key.

Status: REMEDIATED · VERIFIED

DOMAIN
Storage & data
PLATFORM
Amazon EBS, AWS KMS
SEVERITY
High
OUTCOME
Private and encrypted

TOOLS

AWS CLIAmazon EC2Amazon EBS snapshotsAWS KMSAWS IAMEBS snapshot permissionsEncryption at rest
RESULT
BEFOREPublic and unencrypted
AFTERPrivate, encrypted copy
01

Objective

I set out to find publicly shared EBS snapshots, judge whether sensitive data was exposed, remove the public sharing, and replace the snapshot with an encrypted copy.

02

Scenario

A security review, prompted by known snapshot-sharing risks, pointed to an EBS snapshot linked to sensitive data that had been made public. I needed to confirm the sharing and encryption state, remove public access and create an encrypted replacement.

03

What I found

createVolumePermissionPUBLIC
{
  "SnapshotId": "snap-xxxxxxxx",
  "CreateVolumePermissions": [{ "Group": "all" }]
}
FINDING 01HIGH

Shared with every AWS account

The snapshot's volume permissions included the all group, which means any AWS account could create a volume from it.

snapshot-metadataUNENCRYPTED
Encrypted:           False
State:               completed
DataClassification:  Sensitive
FINDING 02MEDIUM

Unencrypted, and tagged sensitive

The same snapshot was not encrypted.

Public and unencrypted together meant a direct path to the data on the volume. Because it had already been exposed for some time, the response also has to include reviewing the snapshot's contents and rotating any credentials or keys stored on that volume.

04

What I did

  1. Found the snapshot

    I identified the account, region and the lab snapshot.

  2. Read its metadata

    It was unencrypted and classified as sensitive.

  3. Checked who it was shared with

    createVolumePermission showed Group: all.

  4. Removed public sharing

    I removed the all group permission.

  5. Made an encrypted copy

    I located the customer-managed key alias/lab-ebs-key and copied the snapshot with encryption on.

EVIDENCE

BASH
aws ec2 modify-snapshot-attribute --snapshot-id "$SNAPSHOT_ID" \
  --attribute createVolumePermission --operation-type remove --group-names all

ENCRYPTED_SNAP=$(aws ec2 copy-snapshot --source-region "$AWS_REGION" \
  --source-snapshot-id "$SNAPSHOT_ID" --region "$AWS_REGION" \
  --encrypted --kms-key-id alias/lab-ebs-key \
  --query SnapshotId --output text)
05

Validation

The original snapshot is no longer shared, and the replacement is encrypted and complete:

TEXT
Original CreateVolumePermissions:   []
Encrypted copy:                     Encrypted true, State completed
06

Before and after

CONTROLBEFOREAFTER
Public sharingGroup: allRemoved
EncryptionFalseEncrypted copy
KMS protectionNot usedCustomer-managed alias/lab-ebs-key
Snapshot stateCompletedCompleted
07

What I recommend

  1. 01Audit EBS snapshots regularly for public sharing.
  2. 02Do not share snapshots with Group: all unless it is explicitly required and approved.
  3. 03Encrypt sensitive snapshots with customer-managed KMS keys.
  4. 04After a confirmed exposure, review what the snapshot held and rotate any credentials or keys on it.
  5. 05Add detection for newly public snapshots.

“Securing EBS snapshots means checking both who they are shared with and whether they are encrypted. An unencrypted public snapshot hands the volume's data to anyone.”

WHAT I LEARNED

SKILLS IT PROVES

  • Cloud Security
  • EBS Snapshot Security
  • AWS KMS
  • Encryption at Rest
  • Access Control
  • Least Privilege
  • Data Protection
  • AWS CLI
View my labs on GitHub