AWS EC2 AMI or Snapshot Shared Publicly

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•36

Detects when an Amazon EC2 AMI (Amazon Machine Image) or Snapshot is modified to be shared publicly. This action can lead to sensitive data exposure or provide adversaries with a way to exfiltrate data by sharing it with an 'all' group, making it accessible to anyone.