Amazon DocumentDB manual cluster snapshots should not be public
Flags DocumentDB manual cluster snapshots that are publicly accessible, which exposes data to all AWS accounts.
- service
- DocumentDB
- severity
- Critical
- scope
- evaluated in every region
How to fix it
Remove `all` from the named snapshot's restore attribute, so only accounts you have named can restore it. Accounts you named keep their access, so this is not the same as unsharing. Any AWS account could have copied it while it was public, and such a copy is beyond your reach, so decide whether the data needs rotating rather than only whether the flag needs clearing. DocumentDB, Neptune and RDS share one snapshot API and this check does not filter by engine, so a public Aurora or Neptune snapshot is reported here too, under a DocumentDB resource type. The fix is the same command.
In the console
Amazon DocumentDB → Snapshots → the snapshot → Manage access
With the AWS CLI
aws docdb modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier <snapshot-identifier> --attribute-name restore --values-to-remove all --region <region>See which of your accounts this check is failing on.
Book a demo