RDS.1: An RDS snapshot is shared publicly

What does AWS Security Hub RDS.1 check?

RDS.1 checks whether a manual RDS snapshot is shared publicly. It reports FAILED the moment a snapshot's restore attribute contains the special group all, which makes it restorable by any AWS account. It covers manual snapshots of RDS instances, Aurora, Neptune, and DocumentDB clusters; automated system snapshots cannot be shared and are out of scope.

Why does RDS.1 matter?

A snapshot is a complete, restorable copy of a database — every row, every PII field, as it stood when taken. A public snapshot hands over the data itself, not just an endpoint behind credentials: anyone who restores it gets a fully working database with your customers' records inside. There is no authentication gate once all is on the restore attribute. The downstream costs are GDPR/HIPAA penalties, breach notification, and legal exposure. The correct count for this finding is zero, always.

How do I fix RDS.1?

1. Immediately make the snapshot private: modify-db-snapshot-attribute --attribute-name restore --values-to-remove all (or the cluster-snapshot equivalent).
2. Audit who restored or copied it while it was public and treat the exposure as an incident.
3. Share future snapshots only with named account IDs, never the all group.
4. Add an SCP denying ModifyDBSnapshotAttribute with restore=all so it cannot recur.

# Set a 7-day backup floor on production databases below it (skip read replicas).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?ReadReplicaSourceDBInstanceIdentifier==`null` && BackupRetentionPeriod<`7`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --backup-retention-period 7 --no-apply-immediately
done

# Turn on DynamoDB point-in-time recovery (instant, no downtime).
aws dynamodb update-continuous-backups --table-name prod-orders \
  --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

# Stop any snapshot in the account from being shared publicly, ever.
aws ec2 enable-snapshot-block-public-access --state block-all-sharing