Lion Cipher Lab
Find and lock down public RDS snapshots
- Cloud Security
- Intermediate
- ~75 min
- Free · no account required
Why it matters
An Amazon RDS snapshot is a complete copy of a database -- every table and every row, including whatever PII, credentials, or payment data lived in it. RDS lets you make a snapshot public with one attribute, `restore` = `all`, so that any of the millions of AWS accounts in the world can restore it into their own account and read the whole database. This is not theoretical: security researchers have repeatedly scanned the public RDS snapshot space and found live databases exposed this way, and because a snapshot is restored inside AWS rather than downloaded over the internet, the theft can…
What you'll learn
- reading the RDS `restore` attribute straight from describe-db-snapshot-attributes JSON: ["all"] = PUBLIC, a list of account IDs = CROSS-ACCOUNT, empty = PRIVATE
- knowing the make-or-break encryption rule: AWS refuses restore=all on an ENCRYPTED snapshot, so every public RDS snapshot is unencrypted -- a full data-at-rest breach of the whole database
- separating a dangerous share from a legitimate one: a cross-account share to an allowlisted partner is fine, the same share to an unknown account is data leaving your control, and an encrypted cross-account share is inert without the KMS key
- catching the gap a snapshot-only check misses: Aurora DB CLUSTER snapshots are a SEPARATE API (describe-db-cluster-snapshots), so a naive grep over DB-snapshot attributes silently misses a public cluster snapshot
- writing a standard-library Python auditor (json, os -- no pip, no boto3, no network) that computes blast radius per snapshot: which DB/cluster, which engine, which data-classification tag
- emitting the exact remediation (modify-db-snapshot-attribute / modify-db-cluster-snapshot-attribute --values-to-remove all) and the PREVENTIVE guardrail (AWS Config rds-snapshots-public-prohibited + an SCP condition on rds:ModifyDBSnapshotAttribute), and why ModifyDBSnapshotAttribute with ValuesToAdd=all is the exact CloudTrail event to alarm on
Steps in this lab
- RDS snapshots and who can restore them -- every term, defined once
- Why an attacker cares -- the encryption twist, and how this differs from the EBS lab
- The live-account mapping (optional, your own account only, read-only first)
- Seed the account as saved CLI output
- Write the auditor -- public, cross-account, allowlisted, private + blast radius
- Measure the BEFORE state -- and what the naive grep misses
- Flip restore off -- the remediation stand-in, and 0 public
- The preventive guardrail -- detective is not enough
- Honest limitations -- what the audit does not and cannot do
- When to use this, when not, and how a pro does it better
- What you built