Infra Audit4 min readUpdated November 4, 2026

The Snapshot You Shared in 2021 Is Still a Full Disk Copy

Snapshots contain everything on the disk: credentials in config files, SSH keys, databases. Sharing one is handing over the machine.

aws ec2 describe-snapshots shows CreateVolumePermissions. Any entry with group: all or another account is a full disk copy in strangers' hands. Same check for RDS snapshot attributes.

Everything the disk held when the snapshot was taken: application configs with database passwords, SSH authorized_keys, environment files, the database itself. A snapshot is not a backup archive with structure; it is the machine. Whoever can create a volume from it boots your server state in their account.

See How We Work

In This Guide

What is inside a snapshot

Everything the disk held when the snapshot was taken: application configs with database passwords, SSH authorized_keys, environment files, the database itself. A snapshot is not a backup archive with structure; it is the machine. Whoever can create a volume from it boots your server state in their account.
Everything the disk held when the snapshot was taken: application configs with database passwords, SSH authorized_keys, environment files, the database itself. A snapshot is not a backup archive with structure; it is the machine. Whoever can create a volume from it boots your server state in their account.

The check that scanners get wrong

describe-snapshots returns CreateVolumePermissions, but the field can be absent even when sharing exists: the definitive check is describe-snapshot-attribute per snapshot. The audit runs both, plus the RDS variant, and reports every shared snapshot as confirmed with the sharing target named.
describe-snapshots returns CreateVolumePermissions, but the field can be absent even when sharing exists: the definitive check is describe-snapshot-attribute per snapshot. The audit runs both, plus the RDS variant, and reports every shared snapshot as confirmed with the sharing target named.

If it stays

The disk copy ages but the credentials inside it often do not: keys and passwords from the snapshot era still work if rotation is lax. Every year the snapshot sits shared is another year a stranger can boot your past.
The disk copy ages but the credentials inside it often do not: keys and passwords from the snapshot era still work if rotation is lax. Every year the snapshot sits shared is another year a stranger can boot your past. The fix is one modify call, and the re-run of the attribute check is the proof.

Get the skill

The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times.
The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times. The full canary report is in the repository under docs/runs. Copy the skill into any coding agent, point it at your stack, and get the same report for your account.

4 Tips to Get Started

1

describe-snapshots does not always show sharing; use describe-snapshot-attribute per snapshot.

2

RDS snapshots have their own attribute: aws rds describe-db-snapshot-attributes.

3

Sharing to account all means every AWS customer can copy it. Sharing to one account means that account can.

4

Old snapshots are the risk: the disk state includes credentials from whenever it was taken.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Related Guides

Is My S3 Bucket Public? How to Check in One Command

One command tells you if your S3 bucket is public, and one curl proves it. The policy check shows intent, the anonymous request shows reality.

The Most Common AWS Misconfiguration (It Is One Line of Config)

Public buckets and Principal * policies cause most disclosed AWS incidents. Each is one line of config with account-wide blast radius. Here is the pattern.

Terraform State File Leak: Every Secret in Plaintext

terraform.tfstate stores database passwords, IAM keys and TLS private keys in plaintext. sensitive=true hides nothing. Here is how leaks happen and the check.

Docker Socket Mounted in a Container: Root on the Host, No Exploit Needed

A container with /var/run/docker.sock mounted controls the host daemon and can mount your entire filesystem. No kernel exploit required. Here is the mechanism and the check.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

What is a shared EBS snapshot risk?

A snapshot shared to another account or to all is a complete disk copy: config files with credentials, SSH keys, databases, everything. Imperva 2019 lost data through an RDS snapshot; the DNC 2016 copies came from EC2 snapshots. The check: aws ec2 describe-snapshots for CreateVolumePermissions, and describe-snapshot-attribute per snapshot for the sharing state.

How do I check if my snapshots are shared?

aws ec2 describe-snapshots --owner-ids self --query 'Snapshots[].{id:SnapshotId,perm:CreateVolumePermissions}' lists sharing. For a definitive answer per snapshot, aws ec2 describe-snapshot-attribute --snapshot-id ID --attribute createVolumePermission. Any group: all entry is public. Do the same for RDS with describe-db-snapshot-attributes.

How do I unshare a snapshot?

aws ec2 modify-snapshot-attribute --snapshot-id ID --attribute createVolumePermission --operation-type remove --group all. For RDS, aws rds modify-db-snapshot-attribute with --attribute-name restore. Then re-run the describe to verify the permission list is empty.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works