AWS RDS Snapshot Shared Publicly

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•2•0•43

This rule detects when an Amazon RDS Snapshot is shared publicly. This action can lead to sensitive data exposure if the snapshot contains confidential information. The detection is based on AWS CloudTrail logs, specifically looking for 'ModifyDBSnapshotAttribute' or 'ModifyDBClusterSnapshotAttribute' events where the 'Request Parameters Values To Add' includes 'all' and 'Request Parameters Attribute Name' is 'restore'. This indicates an attempt to make the snapshot publicly restorable.