All checks

Critical EC2 · regional

EBS snapshots should not be configured to be publicly restorable

Flags EBS snapshots that are configured to be publicly restorable.

service: EC2
severity: Critical
scope: evaluated in every region

How to fix it

Have createVolumePermission on the snapshot granted only to AWS accounts you have named, never to the `all` group that makes it restorable by anyone.

In the console

EC2 → Snapshots → the snapshot → Actions → Modify permissions

With the AWS CLI

aws ec2 modify-snapshot-attribute --snapshot-id <snapshot-id> --attribute createVolumePermission --operation-type remove --group-names all

See which of your accounts this check is failing on.

Book a demo