ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB Snapshots, AMIs & SSM Documents Evades CSPM/CNAPP Scan Cycles — Threadlinqs Intelligence
As of 2026-07-31, ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB Snapshots, AMIs & SSM Documents Evades CSPM/CNAPP Scan Cycles is a medium-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1788 · Severity: MEDIUM · Status: ACTIVE · Category: VULNERABILITY
Aryon Security's ShutterGap research estimates 3,731,699 short-lived AWS resources — RDS/DocumentDB snapshots, AMIs, and SSM documents — are made publicly accessible each year for windows as brief as
ShutterGap is a systemic cloud-security detection gap documented by Aryon Security researchers Ariel Litmanovich, Tom Tsabar, and Ido Dar in the July 29, 2026 report "Millions of Cloud Resources Exposed – The Blind Spot CSPM/CNAPP Tools Don't Cover." It is not a single discrete software flaw with a CVE, but a class of transient AWS misconfiguration: resources that support public-sharing attributes — Amazon RDS DB snapshots, Amazon DocumentDB cluster snapshots, Amazon Machine Images (AMIs), and AWS Systems Manager (SSM) documents (with EBS snapshots and public ECR repositories also examined) — are frequently toggled public during creation, testing, or infrastructure changes, then reverted or deleted long before the next scheduled CSPM/CNAPP scan runs.
Aryon monitored public-sharing state changes for these resource types across multiple AWS regions over several days, deduplicating by resource identifier to project the 3,731,699-per-year exposure estimate, and also drew on a 90-day CloudTrail historical lookback to validate the pattern. Exposure windows were dramatically shorter than typical scan cadences: 20% of publicly shared RDS snapshots were visible for under 2 minutes, and 99% of deleted RDS/DocumentDB snapshots were removed within 30 minutes of creation; roughly 30% of publicly shared SSM documents and AMIs vanished within 24 hours. In a continuous 90-minute observation window in the us-east-1 region on June 28, 2026, public RDS snapshot visibility changed 12 times (6 new exposures, 6 removals) — since re-reported elsewhere as 121 total public-snapshot-count changes across the full multi-region monitoring run. Because most CSPM/CNAPP platforms scan on a periodic (commonly ~24-hour) cycle, the large majority of these exposures come and go entirely undetected.
To validate real-world impact, Aryon built an automated extraction pipeline that restored 24 recently-exposed public RDS snapshots, reset credentials, dumped database contents, and scanned the output with TruffleHog plus custom detection patterns. AWS account identifiers appeared in every analyzed snapshot; roughly 80% of the tested RDS/DocumentDB snapshots contained private business data, and researchers separately identified email addresses, secret-key patterns, private keys, and payment-card-number patterns across the sample. This mirrors and extends earlier findings: Mitiga's September 21–October 20, 2022 study of Amazon RDS snapshots found 810 of 2,783 observed snapshots were publicly exposed during that one-month window and contained PII (addresses, passwords, credit-card details, tokens, phone numbers, passport numbers). Mitiga also established a durable structural gap Aryon's research reinforces: AWS emits no CloudTrail log event when a public snapshot is copied to, or a DB instance is restored from, another AWS account in the snapshot owner's account — meaning a victim organization typically has no way to determine whether an exposed snapshot was actually accessed by an outside party.
The attacker model requires no privileged access to the victim environment: an adversary need only continuously enumerate AWS's public-resource listings (e.g., `aws rds describe-db-snapshots --snapshot-type public`) across regions and, on discovering a newly public snapshot/AMI/document, immediately copy or restore it into an attacker-controlled account before the owner reverts the sharing attribute. Aryon summarizes the core defensive failure: "Detection alone cannot mitigate exposures that attackers can exploit within seconds. A security alert generated hours later is of little value if the snapshot has already been copied." The report's core recommendation is therefore prevention over detection — organization-level AWS Service Control Policies (SCPs) that deny the specific API calls (`rds:ModifyDBSnapshotAttribute`, `rds:ModifyDBClusterSnapshotAttribute`, `ec2:DisableImageBlockPublicAccess`, SSM `UpdateServiceSetting` for document sharing) that make these resources public
Weaknesses (CWE)
CWE-668, CWE-732, CWE-200
Target sectors: cross-sector
Target regions: global
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, MEDIUM, threat intelligence, cybersecurity, T1595, T1596, T1589, T1583, T1580, T1526, T1619, T1087, T1530, T1213
