Security HUB RDS snapshots cannot be public finding

3

Hello Checking out the Security Hub findings, we have multiple reports of a CRITICAL issue with the description Security Hub *RDS.1 RDS snapshot should be private * but the snapshots that are targeted are deleted and are no longer available in the AWS Console RDS snapshots tab. The Record state of the finding is ARCHIVED, but we don't get why the findings were triggered at all on those snapshots ( and also no trigger was found on the current existing ones ). All the snapshots that we have are encrypted and according with the documentation: If the source is encrypted, DB snapshot visibility is set as Private because encrypted snapshots can't be shared as public. so our snapshots should not have gotten in a public state at any point. So what can be the cause of us seeing those Security Hub findings and how can we make sure we no longer have them?

2개 답변
1

Any news on this or work arounds? We got exactly the same issue and we generate automated emails on critical findings of the amazon event bridge. Getting false alerts is a bit annoying.

moritz
답변함 9달 전
  • Same here, we keep getting alerts from our CSOC about these "critical" findings...

  • We appear to have the same issue as well

-1

All snapshots are evaluated by RDS.1. Findings are triggered by the evaluation of the config rule backed by RDS.1. When the snapshot is deleted Config produces a NOT_AVAILABLE finding for the deleted resource which is translated in Security Hub as Record State = ARCHIVED.

AWS
답변함 2년 전
  • Seems like there is some sort of bug in the config rule because we are also getting these CRITICAL SecurityHub findings saying that our automated RDS snapshots are public, which is impossible since they are encrypted (and we have never set them public to begin with).

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인