AWS RDS Database Snapshot Unauthorized External Sharing

Adversaries who obtain valid AWS credentials or exploit misconfigurations may abuse the RDS database snapshot sharing mechanism to perform stealthy data exfiltration. By modifying a snapshot's restore attributes using the ModifyDBSnapshotAttribute or ModifyDBClusterSnapshotAttribute API calls, an attacker can grant an external, attacker-controlled AWS account permission to restore and access the database. Because these snapshots contain complete backups including schemas, sensitive application data, and credentials, sharing them externally bypasses standard network and IAM monitoring controls, as the data extraction occurs in an environment outside the victim's visibility. This technique is particularly effective for large-scale exfiltration, as it allows attackers to analyze the data offline.

Impact

Successful exploitation results in the unauthorized exposure of sensitive database content, including PII, customer data, and internal credentials. Once an external account gains restore permissions, the data is essentially exfiltrated, leading to potential regulatory non-compliance, loss of intellectual property, and increased risk of follow-on attacks using recovered credentials.

Recommendation

Prioritize the implementation of detective and preventive controls to limit cross-account snapshot exposure.

• Deploy the detection rules provided below to monitor CloudTrail for ModifyDBSnapshotAttribute and ModifyDBClusterSnapshotAttribute events.
• Implement AWS Organizations Service Control Policies (SCPs) to strictly prohibit or restrict cross-account snapshot sharing to a known-safe list of accounts.
• Utilize IAM condition keys (e.g., kms:ViaService, rds:dbSnapshotArn) to enforce strict policies on who can modify snapshot permissions.
• Configure AWS Security Hub and Config rules to alert on publicly shared snapshots or snapshots shared with unauthorized external account IDs.