Block sharing outside the organization

How to do it

A snapshot or image holds a full copy of a disk, so one public share leaks every file on it. Blocked public buckets from the account baseline do not cover snapshots or images. On AWS, turn on block public access for EBS snapshots and for machine images in each region. Then create an IAM Access Analyzer with the organization as its zone of trust. It flags buckets, roles, keys, queues, secrets and database snapshots that a principal outside the organization can reach. On Google Cloud, the organization policies for domain restricted sharing and public access prevention do the same job. Fix each finding, or archive it with a written reason when the sharing is meant. Buckets themselves follow Keep storage buckets private.

Examples

Terraform example

resource "aws_ebs_snapshot_block_public_access" "baseline" {
  state = "block-all-sharing"
}

resource "aws_ec2_image_block_public_access" "baseline" {
  state = "block-new-sharing"
}

resource "aws_accessanalyzer_analyzer" "organization" {
  analyzer_name = "organization-external-access"
  type          = "ORGANIZATION"
}

Shell example

# Run in every region in use. Both lines must print the blocked state.
aws ec2 get-snapshot-block-public-access-state --query State --output text
aws ec2 get-image-block-public-access-state --query ImageBlockPublicAccessState --output text
aws accessanalyzer list-findings-v2 --analyzer-arn "$ANALYZER_ARN" \
  --filter '{"status": {"eq": ["ACTIVE"]}}' --query 'findings[].[resource, createdAt]' --output text

How to check

In every region in use, the snapshot setting reads block-all-sharing and the image setting reads block-new-sharing. The analyzer lists no active finding older than 7 days.

Sources

• Block public access for Amazon EBS snapshots
• Using AWS IAM Access Analyzer

Related rules

• Start every account from one baseline in Infrastructure
• Keep storage buckets private in Security testing