Skip to main content

🛡️ AWS EBS Snapshot auto-provisioning status🟢

Stats​

not available

Logic​

Description​

Open File

Description​

Identify AWS EBS Snapshots that appear to be associated with AWS-managed automated provisioning or protection workflows.

This policy checks for AWS-managed tag signals that can identify an EBS snapshot as associated with AWS Backup, Amazon Data Lifecycle Manager, AWS Application Migration Service, or AWS Elastic Disaster Recovery.

Rationale​

AWS-managed service tags can provide evidence that a snapshot was created or managed by an automated AWS workflow. This allows to distinguish snapshots with supported AWS-managed provisioning indicators from snapshots that are not identified by this tag-based method.

Audit​

This policy classifies an AWS EBS Snapshot as identified by automated provisioning evidence when the snapshot has one of the following supported tag signals:

  • aws:backup:source-resource
  • AWSApplicationMigrationServiceManaged with value mgn.amazonaws.com
  • AWSElasticDisasterRecoveryManaged with value drs.amazonaws.com
  • All of these Amazon Data Lifecycle Manager tags together:
    • aws:dlm:lifecycle-policy-id

... see more

Remediation​

Open File

Review​

Review the EBS snapshot and confirm whether it is associated with an expected automated provisioning, backup, migration, or disaster recovery workflow.

If the snapshot was intentionally created or managed outside these AWS-managed workflows, record the appropriate ownership and provisioning context. If the snapshot appears to be associated with AWS Backup, Amazon Data Lifecycle Manager, AWS Application Migration Service, or AWS Elastic Disaster Recovery, validate the source workflow and confirm that the snapshot is still needed.

policy.yaml​

Open File