Security policy states that EBS snapshots containing municipal data must never be shareable publicly. Which control direction should the architect enforce?
Select an answer to reveal the explanation.
Short Explanation
Backups are still sensitive data wearing a different jacket. Block public snapshot sharing with account settings and tight IAM so a misclick does not publish disks to the world. Making snapshots public for “audit convenience” is a breach waiting to happen.
Full Explanation
EBS snapshots of municipal volumes often contain the same sensitive data as live disks. Security policy that snapshots must never be shareable publicly is enforced with account-level block public sharing of EBS snapshots plus least-privilege IAM that denies making snapshots public. Those controls prevent a misclick or overly broad automation from publishing civic disk images to the world while still allowing intentional private sharing to approved accounts when DR or partner workflows require it.
Requiring every snapshot to be public so auditors can download freely turns backups into an open data leak and is never an audit best practice—auditors get controlled access, not anonymous internet reads. Storing snapshots in an unencrypted S3 bucket with a public ACL misunderstands how EBS snapshots are stored and deliberately weakens confidentiality. Disabling IAM so snapshot sharing has no permission boundaries removes the primary authorization plane and invites unrestricted lateral sharing.
Exam caveat: know that AWS provides organization/account settings to block public sharing of snapshots/AMIs; combine with IAM deny statements for defense in depth. Operational check: enable block public snapshot sharing at the account level, attempt a public share in a sandbox and confirm failure, review IAM policies for ec2:ModifySnapshotAttribute, and inventory existing snapshot permissions for accidental public flags.