All checks
Critical
RDS snapshot should be private
Confirms that RDS DB snapshots and DB cluster snapshots are not public. Any AWS account can copy or restore a public snapshot, and making it private does not reach copies already made, so treat its data as disclosed and rotate what it protected. The Terraform and CLI routes fix a DB snapshot; a cluster snapshot takes aws_db_cluster_snapshot or modify-db-cluster-snapshot-attribute.
- service
- RDS
- severity
- Critical
- scope
- evaluated in every region
How to fix it
In the console
RDS → Snapshots → the manual snapshot → Actions → Share snapshot
With the AWS CLI
aws rds modify-db-snapshot-attribute --db-snapshot-identifier <db-snapshot-id> --attribute-name restore --values-to-remove all --region <region>With Terraform
resource "aws_db_snapshot" "this" {
db_instance_identifier = var.db_instance_identifier
db_snapshot_identifier = var.db_snapshot_identifier
shared_accounts = []
}See which of your accounts this check is failing on.
Book a demo