Detection: EBS Snapshot Unlocked

Overview

Detect when an Amazon Elastic Block Store (EBS) snapshot was unlocked. Unlocking a snapshot allows access to its data for a specified duration, which could expose sensitive information if not properly monitored or managed. Monitoring these actions helps ensure data security and compliance with access control policies.

References:

Usage

Run the detection in your terminal:

powerpipe detection run aws_cloudtrail_log_detections.detection.ebs_snapshot_unlocked

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe detection run aws_cloudtrail_log_detections.detection.ebs_snapshot_unlocked --share

SQL

This detection uses a named query:

select
  tp_timestamp as timestamp,
string_split(event_source, '.')[1] || ':' || event_name as operation,
request_parameters -> 'UnlockSnapshotRequest' ->> 'SnapshotId' as resource,
user_identity.arn as actor,
tp_source_ip as source_ip,
tp_index as account_id,
aws_region as region,
tp_id as source_id,
*

from
  aws_cloudtrail_log
where
  event_source = 'ec2.amazonaws.com'
  and event_name = 'UnlockSnapshot'
  and error_code is null

order by
  tp_timestamp desc;

Detection: EBS Snapshot Unlocked

Overview

Usage

SQL

Tags