AWS ebs medium security documentation change

Service: ebs · 2025-05-16 · Security-related medium

File: ebs/latest/userguide/view-shared-snapshot.md

Summary

Updated documentation to clarify snapshot permission verification process. Changed console instructions to focus on ownership checks, added CLI/PowerShell examples showing permission outputs, and restructured content around permission auditing.

Security assessment

The changes emphasize checking snapshot ownership and permissions through multiple methods (console/CLI/PowerShell), which helps users identify unintended public/shared access. The addition of explicit permission output examples and guidance to verify 'createVolumePermission' attributes directly relates to access control security practices.

Diff

diff --git a/ebs/latest/userguide/view-shared-snapshot.md b/ebs/latest/userguide/view-shared-snapshot.md
index 7aec46c6c..5ea0cac02 100644
--- a//ebs/latest/userguide/view-shared-snapshot.md
+++ b//ebs/latest/userguide/view-shared-snapshot.md
@@ -15,2 +14,0 @@ Locate the shared snapshot by ID or description. Create a copy of the shared sna
-You can view snapshots that are shared with you using one of the following methods.
-
@@ -20 +18 @@ Console
-###### To view shared snapshots using the console
+###### To view snapshot permissions
@@ -26,3 +24 @@ Console
-  3. Filter the listed snapshots. In the top-left corner of the screen, choose one of the following options:
-
-     * **Private snapshots** — To view only snapshots that are shared with you privately.
+  3. Select the snapshot.
@@ -30 +26 @@ Console
-     * **Public snapshots** — To view only snapshots that are shared with you publicly.
+  4. If the filter is **Owned by me** , the snapshot is owned by this account. If the filter is **Private snapshots** , the snapshot is either owned by this account or shared specifically with this account. Select a snapshot and on the **Details** tab, check whether **Owner** specifies this account or a different account.
@@ -38 +34,10 @@ AWS CLI
-###### To view snapshot permissions using the command line
+###### To view snapshot permissions
+
+Use the [describe-snapshot-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-snapshot-attribute.html) command to get the snapshot permissions of the specified snapshot.
+    
+    
+    aws ec2 describe-snapshot-attribute \
+        --snapshot-id snap-0abcdef1234567890 \
+        --attribute createVolumePermission
+
+The following is example output.
@@ -40 +45,9 @@ AWS CLI
-Use the [describe-snapshot-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-snapshot-attribute.html) command.
+    
+    {
+        "SnapshotId": "snap-0abcdef1234567890",
+        "CreateVolumePermissions": [
+            {
+                "UserId": "111122223333"
+            }
+        ]
+    }
@@ -45 +58,11 @@ PowerShell
-###### To view snapshot permissions using the command line
+###### To view snapshot permissions
+
+Use the [Get-EC2SnapshotAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2SnapshotAttribute.html) cmdlet.
+    
+    
+    (Get-EC2SnapshotAttribute `
+        -SnapshotId snap-0abcdef1234567890 `
+        -Attribute createVolumePermission).CreateVolumePermissions
+
+The following is example output.
+    
@@ -47 +70,3 @@ PowerShell
-Use the [Get-EC2SnapshotAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2SnapshotAttribute.html) command.
+    Group UserId
+    ----- ------
+          111122223333