cis-aws-compute-2-2-2

name	cis-aws-compute-2.2.2
description	Ensure Public Access to EBS Snapshots is Disabled
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ec2","ebs","snapshots","public-access","permissions"]
cis_id	2.2.2
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-2.1.5","cis-aws-compute-2.2.3","cis-aws-compute-2.2.4"]
prerequisites	[]
severity_boost	{}

Ensure Public Access to EBS Snapshots is Disabled

Description

To protect your data disable the public mode of EBS snapshots.

Rationale

This protects your data so that it is not accessible to all AWS accounts preventing accidental access and leaks.

Impact

Removing public access from EBS snapshots may affect other AWS accounts that rely on them. Ensure private sharing is configured for any authorized accounts.

Audit Procedure

Using AWS CLI

1. For each snapshot, run:

aws ec2 describe-snapshot-attribute \
    --snapshot-id <snapshot-ID> \
    --attribute createVolumePermission

2. Validate Group is not set to all.

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane click Snapshots.
3. Select the snapshot then click Actions, Modify Permissions.
4. Confirm that the snapshot is set to Private.
5. Repeat for any additional Snapshots, Regions and AWS accounts.

If the snapshot is set to public refer to the remediation below.

Expected Result

The createVolumePermission attribute should not contain a Group set to "all". In the console, all snapshots should show as Private.

Remediation

Using AWS CLI

1. For each snapshot, run:

aws ec2 modify-snapshot-attribute \
    --snapshot-id <snapshot-ID> \
    --attribute createVolumePermission \
    --operation remove --group-name all

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane click Snapshots.
3. Select the snapshot then click 'Actions, Modify Permissions'.
4. Click the radio button for Private.
5. Click Save.
6. Repeat for any additional Snapshots, Regions and AWS accounts.

Default Value

By default, EBS snapshots are private when created.

References

1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html