Skip to main content
emnode
Sign up
Compliance Critical severity

AWS Security Hub · EC2

EC2.1: An EBS snapshot is publicly restorable by any account

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub EC2.1 check?

EC2.1 fails the moment any of your EBS snapshots has createVolumePermission set to be restorable by the all group, i.e. publicly restorable. It evaluates periodically at the account level and points at the specific snapshot IDs that are exposed.

Why does EC2.1 matter?

A snapshot shared with all is your entire disk, restorable by any AWS account on earth: list it, copy it, restore it, mount the filesystem. AWS rates this Critical because the failure is not a misconfiguration that might lead to exposure; it is the exposure. Public sharing only works on unencrypted snapshots, so every EC2.1 failure is plaintext data, the worst kind to leak.

How do I fix EC2.1?

  1. Enumerate every publicly restorable snapshot in every region with describe-snapshots --owner-ids self --restorable-by-user-ids all; do not trust the finding's snapshot IDs alone.
  2. Revoke the all group from each one with modify-snapshot-attribute --operation-type remove --group-names all.
  3. Treat it as an incident: pull CloudTrail for the ModifySnapshotAttribute event to find when and by whom each was made public, and scope what was on the source volume.
  4. Enable account-level Block Public Access (EC2.182) in every region so it cannot recur.

Remediation script · bash

# Set a 7-day backup floor on production databases below it (skip read replicas).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?ReadReplicaSourceDBInstanceIdentifier==`null` && BackupRetentionPeriod<`7`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --backup-retention-period 7 --no-apply-immediately
done

# Turn on DynamoDB point-in-time recovery (instant, no downtime).
aws dynamodb update-continuous-backups --table-name prod-orders \
  --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

# Stop any snapshot in the account from being shared publicly, ever.
aws ec2 enable-snapshot-block-public-access --state block-all-sharing

Full walkthrough (console steps, edge cases and verification) in the lesson Configure backups and retention.

Is EC2.1 a false positive?

Revoking the all group stops future access but tells you nothing about the past: snapshots carry no read or copy audit log, so any account could already have copied yours while it was public, and CloudTrail records only when you changed the sharing, not who consumed it.

Full lesson Configure backups and retention Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for EC2 controls ↗ Check your own account for EC2.1 →
Part of the learning path Lock down access

More EC2 controls

  • EC2.2 Default security groups still allow traffic
  • EC2.3 Attached EBS volumes are not encrypted at rest
  • EC2.4 Long-stopped instances are abandoned attack surface
  • EC2.6 No VPC flow logs, so there is no network audit trail
  • EC2.7 New EBS volumes are not encrypted by default
  • EC2.8 IMDSv1 lets an SSRF steal instance credentials
  • EC2.9 Instances are directly reachable on public IPv4
  • EC2.10 EC2 API traffic leaves the VPC over the internet
  • EC2.13 SSH (port 22) is open to the entire internet
  • EC2.14 RDP (port 3389) is open to the entire internet
  • EC2.15 Subnets auto-assign public IPs to new instances
  • EC2.17 Instances with multiple ENIs can bridge network boundaries