# ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB Snapshots, AMIs & SSM Documents Evades CSPM/CNAPP Scan Cycles

> Aryon Security's ShutterGap research estimates 3,731,699 short-lived AWS resources — RDS/DocumentDB snapshots, AMIs, and SSM documents — are made publicly accessible each year for windows as brief as minutes before disappearing, entirely evading periodic CSPM/CNAPP scan cycles. Attackers can enumerate and copy exposed RDS/DocumentDB snapshots into their own AWS account within seconds; testing of 24 restored snapshots found roughly 80% contained sensitive business data including AWS account IDs, email addresses, secret and private-key patterns, and payment-card indicators.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1788
- **ID:** TL-2026-1788
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ShutterGap is a systemic cloud-security detection gap documented by Aryon Security researchers Ariel Litmanovich, Tom Tsabar, and Ido Dar in the July 29, 2026 report "Millions of Cloud Resources Exposed – The Blind Spot CSPM/CNAPP Tools Don't Cover." It is not a single discrete software flaw with a CVE, but a class of transient AWS misconfiguration: resources that support public-sharing attributes — Amazon RDS DB snapshots, Amazon DocumentDB cluster snapshots, Amazon Machine Images (AMIs), and AWS Systems Manager (SSM) documents (with EBS snapshots and public ECR repositories also examined) — are frequently toggled public during creation, testing, or infrastructure changes, then reverted or deleted long before the next scheduled CSPM/CNAPP scan runs.

Aryon monitored public-sharing state changes for these resource types across multiple AWS regions over several days, deduplicating by resource identifier to project the 3,731,699-per-year exposure estimate, and also drew on a 90-day CloudTrail historical lookback to validate the pattern. Exposure windows were dramatically shorter than typical scan cadences: 20% of publicly shared RDS snapshots were visible for under 2 minutes, and 99% of deleted RDS/DocumentDB snapshots were removed within 30 minutes of creation; roughly 30% of publicly shared SSM documents and AMIs vanished within 24 hours. In a continuous 90-minute observation window in the us-east-1 region on June 28, 2026, public RDS snapshot visibility changed 12 times (6 new exposures, 6 removals) — since re-reported elsewhere as 121 total public-snapshot-count changes across the full multi-region monitoring run. Because most CSPM/CNAPP platforms scan on a periodic (commonly ~24-hour) cycle, the large majority of these exposures come and go entirely undetected.

To validate real-world impact, Aryon built an automated extraction pipeline that restored 24 recently-exposed public RDS snapshots, reset credentials, dumped database contents, and scanned the output with TruffleHog plus custom detection patterns. AWS account identifiers appeared in every analyzed snapshot; roughly 80% of the tested RDS/DocumentDB snapshots contained private business data, and researchers separately identified email addresses, secret-key patterns, private keys, and payment-card-number patterns across the sample. This mirrors and extends earlier findings: Mitiga's September 21–October 20, 2022 study of Amazon RDS snapshots found 810 of 2,783 observed snapshots were publicly exposed during that one-month window and contained PII (addresses, passwords, credit-card details, tokens, phone numbers, passport numbers). Mitiga also established a durable structural gap Aryon's research reinforces: AWS emits no CloudTrail log event when a public snapshot is copied to, or a DB instance is restored from, another AWS account in the snapshot owner's account — meaning a victim organization typically has no way to determine whether an exposed snapshot was actually accessed by an outside party.

The attacker model requires no privileged access to the victim environment: an adversary need only continuously enumerate AWS's public-resource listings (e.g., `aws rds describe-db-snapshots --snapshot-type public`) across regions and, on discovering a newly public snapshot/AMI/document, immediately copy or restore it into an attacker-controlled account before the owner reverts the sharing attribute. Aryon summarizes the core defensive failure: "Detection alone cannot mitigate exposures that attackers can exploit within seconds. A security alert generated hours later is of little value if the snapshot has already been copied." The report's core recommendation is therefore prevention over detection — organization-level AWS Service Control Policies (SCPs) that deny the specific API calls (`rds:ModifyDBSnapshotAttribute`, `rds:ModifyDBClusterSnapshotAttribute`, `ec2:DisableImageBlockPublicAccess`, SSM `UpdateServiceSetting` for document sharing) that make these resources public in the first place, combined with mandatory encryption at rest (encrypted RDS/Aurora snapshots cannot be shared publicly) and AMI Block Public Access enforcement.

## MITRE ATT&CK

- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1619 Cloud Storage Object Discovery
- T1087 Account Discovery
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1552 Unsecured Credentials
- T1537 Transfer Data to Cloud Account
- T1651 Cloud Administration Command
- T1585 Establish Accounts
- T1119 Automated Collection
- T1657 Financial Theft

## Sources

- [ShutterGap Exposes Millions of AWS Resources](https://cybersecuritynews.com/shuttergap-exposes-millions-of-aws-resources/)
- [ShutterGap: Aryon Security finds 3.7M AWS cloud resources exposed beyond CSPM/CNAPP visibility](https://www.helpnetsecurity.com/2026/07/29/cspm-blind-spot-report/)
- [Millions of Cloud Resources Exposed – The Blind Spot CSPM/CNAPP Tools Don't Cover (ShutterGap)](https://www.aryon.security/resource/shuttergap-millions-cloud-resources-exposed)
- [ShutterGap Exposes Millions of Misconfigured AWS Resources to Attackers](https://gbhackers.com/shuttergap-exposes-millions-of-misconfigured-aws-resources/)
- [Oops, I Leaked It Again — How Mitiga Found PII in Exposed Amazon RDS Snapshots](https://www.mitiga.io/blog/how-mitiga-found-pii-in-exposed-amazon-rds-snapshots)
- [Thousands of Amazon RDS Snapshots Are Leaking Corporate PII](https://www.darkreading.com/cloud-security/thousands-amazon-rds-snapshots-leaking-corporate-pii)
- [Publicly shared RDS snapshot — Cloud Security Atlas](https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/rds-snapshot-publicly-shared/)
- [Remediating exposures for Amazon RDS instances and clusters](https://docs.aws.amazon.com/securityhub/latest/userguide/exposure-rds.html)
- [rds-snapshots-public-prohibited — AWS Config Managed Rule](https://docs.aws.amazon.com/ko_kr/config/latest/developerguide/rds-snapshots-public-prohibited.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1788