Home / Knowledge hub / Snapshot exposure
Knowledge hub
Snapshot exposure
Disk or database backups shared or left public by mistake.
What it means
A snapshot is a point-in-time copy of a disk or database, taken for backup, for cloning or before a change. Snapshot exposure is when one of those copies is shared with the wrong account, or made public, so people who should never see it can restore it.
A snapshot is not a single file. It holds the whole disk or database: customer records, application code, configuration, logs and secrets left behind in them. Whoever restores it can look at everything. That is why a snapshot deserves the same care as production.
Why it matters
Because it is a copy, it bypasses every control on the live system. No sign-in screen, no authorisation check and no rate limit sits in front of a restored disk. A reachable snapshot can lead to a full data breach or to stolen keys that open further systems.
These incidents rarely involve skill. A permission set wide for a test, a sharing option left from a migration or an automation script that shares with the wrong account is enough. Exposure may last months, as nobody looks at the backup list.
How it shows up
Cloud providers let you share snapshots with other accounts or, for unencrypted ones, with the public. AWS, for instance, does not allow an encrypted snapshot to be made public, which is one reason to encrypt. Look at sharing settings for disk, database and image snapshots, including old ones and those in other regions.
Encrypt backups with a key whose use you control, restrict who can share or copy them, and alert on any sharing change. Review the snapshot list regularly and delete what you no longer need. The related risks are bucket exposure and wider cloud misconfiguration.
Questions people ask
Snapshot exposure, answered
Can a snapshot be public?
On some platforms, yes, for unencrypted snapshots. Public means any account can find and copy it. Block public sharing at the account level where the provider offers that.
Check the setting for each region.
Does encrypting a snapshot fix exposure?
It helps a lot. A copy encrypted with a key you control is useless to someone who cannot use the key. But sharing the key as well as the snapshot undoes it.
Control both together.
What do attackers find in a snapshot?
Databases of customer data, configuration files with passwords, private keys, application source and logs. All of it is readable once the disk is attached.
Treat a snapshot as sensitive as production.
How do we audit our snapshots?
List every snapshot in every region and account, and check who each is shared with. Look for public sharing, sharing to unknown account IDs and snapshots with no owner.
Automate the check and run it often.
Is this the same as a backup leak?
It is one kind. Backups can also leak through storage buckets, file shares or laptops. Snapshots are the form specific to cloud disks and databases.
The lesson is the same: protect copies like originals.
Sources
Where this comes from
Related
Terms that sit next to this one
S3 bucket exposure
A cloud storage bucket left open so anyone on the internet can read its files.
Cloud misconfiguration
A cloud setting left unsafe, such as open storage or an overly broad permission.
Data breach
Information you hold ends up somewhere it should not be.
Encryption at rest
Stored data scrambled so a stolen disk is useless without the key.
Cloud key management
Using the provider's managed service to create, store and rotate encryption keys.
Is your backup as private as production?
We find what your running app and its APIs expose, including links and tokens that reach stored data, and prove it with the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.