ShutterGap Lets Attackers Copy Briefly Public AWS Snapshots Before Security Tools See Them

Aryon Security disclosed "ShutterGap," a cloud visibility gap that allows attackers to discover and copy briefly exposed public AWS resources before CSPM and CNAPP scans detect them. The issue stems from customer misconfigurations rather than an AWS flaw and affects public-sharing features for resources including Amazon RDS snapshots, Amazon DocumentDB snapshots, Amazon Machine Images (AMIs), and AWS Systems Manager documents. Aryon reported that many exposures are extremely short-lived: about 20% of public RDS snapshots were visible for less than two minutes, and 99% of deleted RDS and DocumentDB snapshots disappeared within 30 minutes of creation.

Researchers showed that once a public snapshot is copied into another AWS account, it can be analyzed later even after the owner revokes access, creating a durable data-exposure risk from fleeting mistakes. In a sample of 24 public RDS snapshots, Aryon found AWS account IDs, email addresses, potential secrets, private-key-related patterns, and signs of financial data; earlier research by Mitiga similarly found hundreds of exposed public RDS snapshots and identified databases containing PII, password hashes, tokens, and business data. The findings underscore that short-lived public sharing can still lead to lasting compromise, and the recommended mitigations include blocking public sharing where possible, enforcing encryption and least privilege, applying Service Control Policies, and monitoring public-sharing events with CloudTrail, AWS Config, and Trusted Advisor.