Recent research has uncovered a significant security concern in cloud environments, termed “ShutterGap,” where temporary exposures of AWS resources occur between routine security scans. This phenomenon arises when cloud assets are made publicly accessible for brief periods—sometimes mere minutes—before being secured again. Such fleeting exposures can be exploited by attackers who continuously monitor for publicly available AWS resources, enabling them to access sensitive data before security teams can respond.
Understanding ShutterGap
ShutterGap is not the result of inherent vulnerabilities within AWS but stems from misconfigurations by users, particularly concerning AWS’s public-sharing features. Despite AWS’s advisories against storing sensitive information in publicly shared resources, inadvertent exposures persist. The issue is exacerbated by the transient nature of these exposures, which often occur during the creation, testing, or modification of cloud infrastructure.
Researchers monitored various AWS resource types that support public sharing, including Amazon RDS snapshots, Amazon DocumentDB snapshots, Amazon Machine Images (AMIs), and AWS Systems Manager documents. Their analysis revealed a constant flux of resources appearing and disappearing from public listings. For instance, in the us-east-1 region, the number of publicly available RDS snapshots changed 12 times within a 90-minute window, with six snapshots appearing and six being removed. Notably, 20% of publicly shared RDS snapshots were visible for less than two minutes, and 99% of deleted RDS and DocumentDB snapshots disappeared within 30 minutes of their creation.
Exploitation Risks
The transient nature of these exposures presents a significant challenge. Attackers do not need to download entire databases during the brief exposure periods. Instead, they can initiate a snapshot copy to another AWS account while the resource is publicly accessible. Once the copy is complete, the attacker can restore and examine the database at their leisure, even if the original owner quickly revokes public access. In a sample of 24 publicly shared RDS snapshots, researchers found sensitive information, including AWS account identifiers, email addresses, potential secrets, patterns related to private keys, and indicators of financial data.
This research underscores the critical need for organizations to prioritize preventive measures over detection. Given that attackers can exploit these exposures within seconds, security alerts generated hours later are of limited value. Implementing preventive AWS controls, such as Service Control Policies, is essential. Organizations should block changes to snapshot-sharing attributes, require encryption for new RDS instances, maintain restrictions on public sharing of AMIs, and enable protections to prevent public sharing of SSM documents. Additionally, reviewing AWS CloudTrail logs for public-sharing events can help identify and mitigate potential exposures.
In the rapidly evolving cloud landscape, the ShutterGap phenomenon highlights the importance of proactive security measures. Organizations must recognize that when configurations can be exploited instantly, prevention must take precedence over detection. By implementing robust preventive controls and continuously monitoring for misconfigurations, businesses can safeguard their sensitive data against opportunistic attacks.
