---
title: AWS EBS Snapshot Made Public
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > AWS EBS Snapshot Made Public
---

# AWS EBS Snapshot Made Public
Classification:attackTactic:[TA0009-collection](https://attack.mitre.org/tactics/TA0009)Technique:[T1530-data-from-cloud-storage](https://attack.mitre.org/techniques/T1530) 
## Goal{% #goal %}

Detect when an EBS snapshot is made public.

## Strategy{% #strategy %}

This rule lets you monitor these CloudTrail API calls to detect when an EBS snapshot is made public:

- [ModifySnapshotAttribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-snapshot-attribute.html#examples)

This rule inspects the `@requestParameters.createVolumePermission.add.items.group` array to determine if the string `all` is contained. This is the indicator which means the EBS snapshot is made public.

## Triage and response{% #triage-and-response %}

1. Determine if the EBS snapshot should be made public.
1. Determine which user, `{{@@userIdentity.arn}}`, in your organization made the EBS snapshot public.
1. Contact the user to see if they intended to make the EBS snapshot public.
1. If the user did not make the API call:
   - Rotate the credentials.
   - Investigate if the same credentials made other unauthorized API calls.
   - Revert AMI permissions to the original state.
   - Begin your company's IR process and investigate.

## Changelog{% #changelog %}

11 November 2022 - Added additional triage and response steps.