Neptune DB cluster snapshots should not be public

How to fix it

Remove `all` from the named snapshot's restore attribute, so only accounts you have named can restore it. Accounts you named keep their access, so this is not the same as unsharing. Any AWS account could have copied it while it was public, and such a copy is beyond your reach, so decide whether what the graph held needs rotating rather than only whether the flag needs clearing. Neptune, DocumentDB and RDS share one snapshot API and this check does not filter by engine, so a public Aurora or DocumentDB snapshot is reported here too, under a Neptune resource type. The fix is the same command.

In the console

Neptune → Snapshots → the snapshot → Manage snapshot sharing

With the AWS CLI

aws neptune modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier <snapshot-identifier> --attribute-name restore --values-to-remove all --region <region>