Security policy states that EBS snapshots containing municipal data must never be shareable publicly. Which control direction should the architect enforce?
Select an answer to reveal the explanation.
Short Explanation
Backups are still sensitive data wearing a different jacket. Block public snapshot sharing with account settings and tight IAM so a misclick does not publish disks to the world. Making snapshots public for “audit convenience” is a breach waiting to happen.
Full Explanation
Preventing public sharing of EBS snapshots is a data-protection control implemented through AWS account-level block-public-sharing settings and least-privilege IAM that denies public snapshot attributes. Mandating public snapshots, dumping them to public S3, or removing IAM boundaries increases exposure of backup data.