Cloud security teams often utilize Cloud Security Posture Management (CSPM) and Cloud-Native Application Protection Platform (CNAPP) tools to identify risky configurations.
However, new research from Aryon Security reveals that this approach may overlook a significant class of threats: temporary AWS resources that are publicly exposed but removed before the next scan occurs.
Aryon refers to this visibility gap as “ShutterGap.” It happens when a cloud resource is made public for a brief period, sometimes lasting only a few minutes.
Attackers can continuously monitor public AWS resources, quickly discover newly exposed snapshots, and copy them into their own cloud accounts before defenders can respond.
ShutterGap Exposes AWS Resources
This issue does not arise from an AWS vulnerability rather, it is the result of customer configuration errors related to AWS’s public-sharing features. AWS advises customers against storing sensitive data in publicly shared resources. Yet, Aryon found that real-world exposures still occur frequently.
The researchers monitored various AWS resource types that support public sharing, including , Amazon DocumentDB snapshots, Amazon Machine Images, and AWS Systems Manager documents. Their analysis revealed a constant flow of resources appearing and disappearing from public listings.
In one instance, the number of publicly available RDS snapshots in the us-east-1 region changed 12 times within 90 minutes, with six snapshots appearing and six being removed.
This activity suggests that organizations may inadvertently expose resources for a brief period during the creation, testing, or modification of cloud infrastructure. Aryon discovered that 20% of publicly shared RDS snapshots were visible for less than two minutes.
Additionally, 99% of deleted RDS and DocumentDB snapshots disappeared within 30 minutes of their creation. These exposure windows are significantly shorter than the daily scan cycles used by many CSPM platforms.
An attacker does not need to download an entire database during the exposure period. They can initiate a snapshot copy to another AWS account while the resource is publicly accessible.
Once the copy is complete, the attacker can restore and examine the database later, even if the original owner quickly revokes public access. The researchers tested a small sample of 24 publicly shared RDS snapshots and found significant information in the restored databases.
The data included AWS account identifiers, email addresses, potential secrets, patterns related to private keys, and indicators of financial data. Aryon ceased data extraction after confirming that public snapshots could contain valuable business information.
The CSPM blind spot lets attackers access exposed resources before detection or remediation (source: Aryon)
The report emphasizes that detection alone cannot mitigate exposures that attackers can exploit within seconds. A security alert generated hours later is of little value if the snapshot has already been copied. Aryon recommends implementing preventive AWS controls, particularly Service Control Policies.
Organizations can block changes to snapshot-sharing attributes, require encryption for new RDS instances, maintain the block on public sharing of Amazon Machine Images (AMIs), and enable protections to prevent public sharing of SSM documents.
Security teams should also review AWS CloudTrail logs for public-sharing events, including actions such as RDS ModifyDBSnapshotAttribute, EC2 ModifyImageAttribute, and SSM ModifyDocumentPermission.
This research reinforces a fundamental lesson in cloud security: when a configuration can be exploited instantly, prevention must take precedence over detection.
