medium advisory November 10, 2026

AWS EC2 snapshot permission modification

Attackers may modify EC2 snapshot attributes to share them with unauthorized AWS accounts for data exfiltration.

Triage facts

Revision 1

Applicability: AWS EC2
Evidence: Unknown
Severity: Medium
Action: Elevated
Sources: 2 public sources
Freshness: Revision 1Nov 10, 02:36 UTC
Detection: 1 rule
Source quality: A1Likely

Unauthorized modification of EC2 snapshot permissions, specifically using the 'ModifySnapshotAttribute' API call, can allow an attacker to share sensitive data with an external AWS account. This technique is often a precursor to data exfiltration in cloud environments.

Impact

Successful exploitation allows for the unauthorized copying of EBS volumes and the data contained within them to an adversary-controlled AWS account.

Recommendation

Deploy the detection rule below to identify when snapshot attributes are modified. Audit IAM policies to restrict the 'ec2:ModifySnapshotAttribute' permission to only authorized identity and access management (IAM) roles and users. Regularly review snapshots shared with external accounts via the 'DescribeSnapshotAttribute' API.

Immediate actions

Deploy the provided detection rule and alert on ModifySnapshotAttribute events

Detection Engineering 48h

Mitigations

Implement IAM Service Control Policies (SCPs) to restrict ec2:ModifySnapshotAttribute to specific approved roles

medium Cloud Infrastructure

T1537

Detection coverage 1

Detect AWS Snapshot Attribute Modification

medium

Detects the modification of an EC2 snapshot attribute, which could indicate unauthorized sharing of snapshots with external accounts.

sigma tactics: exfiltration techniques: T1537 sources: cloudtrail, aws

Detection queries are available on the platform. Get full rules →