Control: 3 Amazon DocumentDB manual cluster snapshots should not be public
Description
This control checks whether an Amazon DocumentDB manual cluster snapshot is public. The control fails if the manual cluster snapshot is public.
An Amazon DocumentDB manual cluster snapshot should not be public unless intended. If you share an unencrypted manual snapshot as public, the snapshot is available to all AWS accounts. Public snapshots may result in unintended data exposure.
Remediation
To remove public access for Amazon DocumentDB manual cluster snapshots, see Sharing a snapshot in the Amazon DocumentDB Developer Guide. Programmatically, you can use the Amazon DocumentDB operation modify-db-snapshot-attribute. Set attribute-name as restore and values-to-remove as all.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_docdb_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_docdb_3 --shareSQL
This control uses a named query:
docdb_cluster_snapshot_restrict_public_access