EBS volume snapshot should not be shared with external accounts

ebs

Description

This rule evaluates whether Amazon Elastic Block Store (Amazon EBS) volume snapshots are shared with external AWS accounts that are not onboarded to Datadog. EBS snapshots contain point-in-time copies of your volumes and may include sensitive data. Sharing snapshots with unauthorized external accounts can lead to data exposure and security risks.

The data contained in the create_volume_permissions field is enumerated and the following types of principals are assessed:

  • user_id - designates an AWS account

The control fails if any AWS account present in create_volume_permissions is not onboarded to Datadog.

Note: If the snapshot is shared with a trusted third-party AWS account that you cannot onboard to Datadog, mute the finding and leave a comment documenting the justification.

Remediation

To remove external account sharing permissions from Amazon EBS snapshots, follow the steps outlined in the Sharing an Amazon EBS snapshot section of the Amazon EC2 User Guide. For guidance regarding onboarding AWS accounts to Datadog, follow the Datadog AWS integration documentation to onboard the account. Ensure that resource collection and Cloud Security are correctly configured.