English
Español
Français
Deutsch
日本語
한국어
العربيةSnapshot EBS volume for exfil
Can snapshot an EBS volume and read the copy elsewhere.
Grants escalation on its own.
ec2:CreateSnapshotOn its own, ec2:CreateSnapshot can snapshot an EBS volume and read the copy elsewhere. On a wide resource scope that alone reaches access for an outside or public principal.
Why it is dangerous
A principal can call ec2:CreateSnapshot on the volume to take a full point-in-time copy of the disk, then restore or share that copy out of band. Unlike detach-and-reattach this needs one permission, no instance in the volume's Availability Zone, and does not disturb the running workload - which makes it the quieter and far more common route to the same data.
In MITRE ATT&CK terms this maps to T1005, Data from Local System, under the collection tactic. AWS records it in CloudTrail as CreateSnapshot. The call is quiet against normal activity, so it is easy to miss without a rule for it.
Detection
CreateSnapshotPrerequisites
ec2:CreateSnapshot on the volume; a way to read the copy afterwards (CreateVolume + attach, or ModifySnapshotAttribute to share it out); kms grants if the volume is CMK-encrypted.
MITRE ATT&CK
T1005 · Data from Local SystemTactic
Collection
A control that would remove it: Restrict ec2:CreateSnapshot to backup automation; encrypt volumes with a CMK the principal cannot use, and deny ec2:ModifySnapshotAttribute so a copy cannot be shared out.
Whether to apply it depends on how the permission is used in your environment, so it is a business decision rather than an automatic fix. The same permission can be load-bearing in one account and pure risk in another.
Pathbreak confirms whether this path resolves in your account, ranks it against the others by how much it opens up, and uses your threat model and business context to show which paths are worth cutting.
Questions
What does ec2:CreateSnapshot allow?
Can snapshot an EBS volume and read the copy elsewhere.
Can ec2:CreateSnapshot escalate privileges on its own?
Yes. Held on a broad enough resource it reaches access for an outside or public principal with no other permission.
How is snapshot EBS volume for exfil detected?
Watch for CreateSnapshot in CloudTrail. The call is quiet against normal activity, so it is easy to miss without a rule for it.
How do you break this path?
A control that would remove it is: Restrict ec2:CreateSnapshot to backup automation; encrypt volumes with a CMK the principal cannot use, and deny ec2:ModifySnapshotAttribute so a copy cannot be shared out. Whether to apply it depends on how the permission is used in your account, so it is a business decision rather than an automatic fix.
Which MITRE ATT&CK technique is this?
T1005, Data from Local System, under the collection tactic.
Related paths
References
Find this in your own account
We run a read-only scan of one AWS account and show you which of these paths exist, ranked by blast radius, with the change that breaks each one. First validated paths within the hour.