---
title: "Block sharing outside the organization · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/block-external-sharing
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Block sharing outside the organization

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: INF-59
- Level: Required
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)
- Rule: Block public sharing of disk snapshots and machine images in every region you use. Run an external access analyzer over the whole organization, and close each finding within 7 days.
- Risk: Data leaked or lost
- How: A snapshot or image holds a full copy of a disk, so one public share leaks every file on it. Blocked public buckets from the [account baseline](https://agentwranglers.se/playbook/infrastructure/environments/account-baseline) do not cover snapshots or images. On AWS, turn on block public access for EBS snapshots and for machine images in each region. Then create an IAM Access Analyzer with the organization as its zone of trust. It flags buckets, roles, keys, queues, secrets and database snapshots that a principal outside the organization can reach. On Google Cloud, the organization policies for domain restricted sharing and public access prevention do the same job. Fix each finding, or archive it with a written reason when the sharing is meant. Buckets themselves follow [Keep storage buckets private](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets).
- Check: In every region in use, the snapshot setting reads `block-all-sharing` and the image setting reads `block-new-sharing`. The analyzer lists no active finding older than 7 days.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Terraform example

```hcl
resource "aws_ebs_snapshot_block_public_access" "baseline" {
  state = "block-all-sharing"
}

resource "aws_ec2_image_block_public_access" "baseline" {
  state = "block-new-sharing"
}

resource "aws_accessanalyzer_analyzer" "organization" {
  analyzer_name = "organization-external-access"
  type          = "ORGANIZATION"
}
```

### Shell example

```sh
# Run in every region in use. Both lines must print the blocked state.
aws ec2 get-snapshot-block-public-access-state --query State --output text
aws ec2 get-image-block-public-access-state --query ImageBlockPublicAccessState --output text
aws accessanalyzer list-findings-v2 --analyzer-arn "$ANALYZER_ARN" \
  --filter '{"status": {"eq": ["ACTIVE"]}}' --query 'findings[].[resource, createdAt]' --output text
```

## Sources

- [Block public access for Amazon EBS snapshots](https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots.html)
- [Using AWS IAM Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html)

## Related rules

- [Start every account from one baseline](https://agentwranglers.se/playbook/infrastructure/environments/account-baseline) in Infrastructure
- [Keep storage buckets private](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets) in Security testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/identity-and-access/block-external-sharing">Agent Wranglers infrastructure playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Grant admin access for hours only](https://agentwranglers.se/playbook/infrastructure/identity-and-access/just-in-time-access)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)