Threat reportVulnerabilityTL-2026-1788
ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB Snapshots, AMIs & SSM Documents Evades CSPM/CNAPP Scan Cycles
ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB (TL-2026-1788), also tracked as ShutterGap, is a medium-severity software vulnerability, first published 2026-07-31. It has no confirmed attribution, affects Amazon Web Services Amazon RDS (DB snapshots), maps to 16 MITRE ATT&CK techniques (T1087, T1119, T1213), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-1788
- Threat ID
- TL-2026-1788
- Also known as
- ShutterGap
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cross-sector
- Target regions
- global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB
Malware and tooling: TruffleHog - S9009
How ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB works
Aryon Security's ShutterGap research estimates 3,731,699 short-lived AWS resources — RDS/DocumentDB snapshots, AMIs, and SSM documents — are made publicly accessible each year for windows as brief as minutes before disappearing, entirely evading periodic CSPM/CNAPP scan cycles. Attackers can enumerate and copy exposed RDS/DocumentDB snapshots into their own AWS account within seconds; testing of 24 restored snapshots found roughly 80% contained sensitive business data including AWS account IDs, email addresses, secret and private-key patterns, and payment-card indicators.
ShutterGap is a systemic cloud-security detection gap documented by Aryon Security researchers Ariel Litmanovich, Tom Tsabar, and Ido Dar in the July 29, 2026 report "Millions of Cloud Resources Exposed – The Blind Spot CSPM/CNAPP Tools Don't Cover." It is not a single discrete software flaw with a CVE, but a class of transient AWS misconfiguration: resources that support public-sharing attributes — Amazon RDS DB snapshots, Amazon DocumentDB cluster snapshots, Amazon Machine Images (AMIs), and AWS Systems Manager (SSM) documents (with EBS snapshots and public ECR repositories also examined) — are frequently toggled public during creation, testing, or infrastructure changes, then reverted or deleted long before the next scheduled CSPM/CNAPP scan runs.
Aryon monitored public-sharing state changes for these resource types across multiple AWS regions over several days, deduplicating by resource identifier to project the 3,731,699-per-year exposure estimate, and also drew on a 90-day CloudTrail historical lookback to validate the pattern. Exposure windows were dramatically shorter than typical scan cadences: 20% of publicly shared RDS snapshots were visible for under 2 minutes, and 99% of deleted RDS/DocumentDB snapshots were removed within 30 minutes of creation; roughly 30% of publicly shared SSM documents and AMIs vanished within 24 hours. In a continuous 90-minute observation window in the us-east-1 region on June 28, 2026, public RDS snapshot visibility changed 12 times (6 new exposures, 6 removals) — since re-reported elsewhere as 121 total public-snapshot-count changes across the full multi-region monitoring run. Because most CSPM/CNAPP platforms scan on a periodic (commonly ~24-hour) cycle, the large majority of these exposures come and go entirely undetected.
To validate real-world impact, Aryon built an automated extraction pipeline that restored 24 recently-exposed public RDS snapshots, reset credentials, dumped database contents, and scanned the output with TruffleHog plus custom detection patterns. AWS account identifiers appeared in every analyzed snapshot; roughly 80% of the tested RDS/DocumentDB snapshots contained private business data, and researchers separately identified email addresses, secret-key patterns, private keys, and payment-card-number patterns across the sample. This mirrors and extends earlier findings: Mitiga's September 21–October 20, 2022 study of Amazon RDS snapshots found 810 of 2,783 observed snapshots were publicly exposed during that one-month window and contained PII (addresses, passwords, credit-card details, tokens, phone numbers, passport numbers). Mitiga also established a durable structural gap Aryon's research reinforces: AWS emits no CloudTrail log event when a public snapshot is copied to, or a DB instance is restored from, another AWS account in the snapshot owner's account — meaning a victim organization typically has no way to determine whether an exposed snapshot was actually accessed by an outside party.
The attacker model requires no privileged access to the victim environment: an adversary need only continuously enumerate AWS's public-resource listings (e.g., `aws rds describe-db-snapshots --snapshot-type public`) across regions and, on discovering a newly public snapshot/AMI/document, immediately copy or restore it into an attacker-controlled account before the owner reverts the sharing attribute. Aryon summarizes the core defensive failure: "Detection alone cannot mitigate exposures that attackers can exploit within seconds. A security alert generated hours later is of little value if the snapshot has already been copied." The report's core recommendation is therefore prevention over detection — organization-level AWS Service Control Policies (SCPs) that deny the specific API calls (`rds:ModifyDBSnapshotAttribute`, `rds:ModifyDBClusterSnapshotAttribute`, `ec2:DisableImageBlockPublicAccess`, SSM `UpdateServiceSetting` for document sharing) that make these resources public in the first place, combined with mandatory encryption at rest (encrypted RDS/Aurora snapshots cannot be shared publicly) and AMI Block Public Access enforcement.
MITRE ATT&CK techniques used in TL-2026-1788
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery; T1619 Cloud Storage Object Discovery
Collection
T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Exfiltration
T1537 Transfer Data to Cloud Account
Credential Access
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts
Reconnaissance
T1589 Gather Victim Identity Information; T1595 Active Scanning; T1596 Search Open Technical Databases
Execution
T1651 Cloud Administration Command
Impact
Affected products and versions in ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB
- Amazon Web Services — Amazon RDS (DB snapshots)
Vulnerable versions: any RDS snapshot with the public sharing attribute enabled
Fixed in: N/A - configuration control via SCP + encryption, not a version patch - Amazon Web Services — Amazon DocumentDB (cluster snapshots)
Vulnerable versions: any DocumentDB snapshot with the public sharing attribute enabled
Fixed in: N/A - configuration control via SCP + encryption, not a version patch - Amazon Web Services — Amazon EC2 (AMIs)
Vulnerable versions: any AMI shared publicly with AMI Block Public Access disabled
Fixed in: N/A - mitigated via AMI Block Public Access (default-enabled) plus SCP lock on DisableImageBlockPublicAccess - Amazon Web Services — AWS Systems Manager (SSM Documents)
Vulnerable versions: any SSM document with the public sharing permission enabled
Fixed in: N/A - mitigated via UpdateServiceSetting restriction plus SCP lock
Remediation for ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB
Immediate actions
- Deploy AWS Service Control Policies (SCPs) denying rds:ModifyDBSnapshotAttribute and rds:ModifyDBClusterSnapshotAttribute at the organization/OU level to block public RDS/Aurora snapshot sharing before it can occur
- Enable AMI Block Public Access at the account level and lock it with an SCP denying ec2:DisableImageBlockPublicAccess
- Enable and lock AWS Systems Manager public document-sharing restrictions via a denial SCP on the relevant UpdateServiceSetting action
- Run aws rds describe-db-snapshots --include-public across the manual, automated, and awsbackup snapshot types in every region to identify any currently-public snapshots, then immediately run aws rds modify-db-snapshot-attribute --attribute-name restore --values-to-remove all to revoke public access
- Review AWS CloudTrail for ModifyDBSnapshotAttribute, ModifyDBClusterSnapshotAttribute, ModifyImageAttribute, and ModifyDocumentPermission events to identify who or what made resources public and when
Workarounds
- Where public sharing cannot be immediately blocked by policy, manually audit and revoke public snapshot/AMI/SSM-document sharing on a recurring short-interval schedule (minutes, not hours) until SCP enforcement is deployed
Longer-term hardening
- Enforce encryption at rest for all new RDS/Aurora instances and snapshots — encrypted snapshots cannot be shared publicly
- Shift from periodic (e.g. 24-hour) CSPM/CNAPP scanning to real-time, event-driven detection on CloudTrail attribute-change events for snapshot, AMI, and SSM-document sharing
- Adopt prevention-first controls (SCPs blocking the sharing APIs) rather than relying solely on detect-and-remediate CSPM workflows, since observed exposure windows (20% of RDS snapshots visible under 2 minutes) are shorter than realistic detection-to-remediation latency
- Restrict snapshot, AMI, and SSM-document sharing to explicit, named AWS account allow-lists instead of public sharing whenever cross-account access is genuinely required
- Alert on CopyDBSnapshot and RestoreDBInstanceFromDBSnapshot actions originating from unrecognized external AWS account IDs
Weaknesses (CWE) in ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB
Timeline of ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB
- Mitiga begins a one-month monitoring study of publicly shared Amazon RDS snapshots (Sept 21 - Oct 20, 2022), the precedent research establishing that transient public RDS exposure regularly leaks PII.
- Mitiga's study concludes: 810 of 2,783 observed RDS snapshots were found publicly exposed and contained PII, and researchers confirm AWS emits no CloudTrail log event when a public snapshot is copied or a DB instance restored into another account - the same structural blind spot ShutterGap later quantifies at scale.
- Aryon Security records a continuous 90-minute monitoring window in AWS region us-east-1 during which public RDS snapshot visibility changes 12 times (6 new exposures, 6 removals) - later re-reported elsewhere as 121 total public-snapshot-count changes across the full multi-region monitoring run - the core empirical basis for the ShutterGap exposure-window statistics.
- Help Net Security publishes 'ShutterGap: Aryon Security finds 3.7M AWS cloud resources exposed beyond CSPM/CNAPP visibility,' the first outlet to independently cover the report.
- Aryon Security researchers Ariel Litmanovich, Tom Tsabar, and Ido Dar publish 'Millions of Cloud Resources Exposed - The Blind Spot CSPM/CNAPP Tools Don't Cover,' naming the finding ShutterGap and estimating 3,731,699 short-lived AWS resources are publicly exposed annually.
- Datadog Security Labs publishes a 'Publicly shared RDS snapshot' entry in its Cloud Security Atlas and AWS's own 'Remediating exposures for Amazon RDS instances and clusters' Security Hub documentation is referenced in coverage the same day, amplifying vendor-level remediation guidance alongside the ShutterGap findings.
- TL-Intel Harness ingests the ShutterGap coverage into the threat backlog as TL-2026-1788 on the strength of confirmed real-world exploitability and large affected scale, despite the absence of an assigned CVE or CVSS score.
- Cyber Security News coverage frames the ShutterGap finding against a cited industry-average 2026 data-breach cost of $4.99 million, underscoring the financial stakes of exposures that occur and vanish faster than CSPM/CNAPP detection-to-remediation cycles can respond.
- Cyber Security News and GB Hackers independently publish coverage of the ShutterGap findings, including the AWS Service Control Policy mitigation guidance, widening industry awareness of the detection gap.
Sources cited for ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB
- ShutterGap Exposes Millions of AWS Resources
- ShutterGap: Aryon Security finds 3.7M AWS cloud resources exposed beyond CSPM/CNAPP visibility
- Millions of Cloud Resources Exposed – The Blind Spot CSPM/CNAPP Tools Don't Cover (ShutterGap)
- ShutterGap Exposes Millions of Misconfigured AWS Resources to Attackers
- Oops, I Leaked It Again — How Mitiga Found PII in Exposed Amazon RDS Snapshots
- Thousands of Amazon RDS Snapshots Are Leaking Corporate PII
- Publicly shared RDS snapshot — Cloud Security Atlas
- Remediating exposures for Amazon RDS instances and clusters
- rds-snapshots-public-prohibited — AWS Config Managed Rule
Detection coverage for TL-2026-1788
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1788 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.