ShutterGap Exposes Millions of Misconfigured AWS Resources to Attackers

A cloud-security blind spot known as Cloud ShutterGap, which involves millions of AWS resources being briefly exposed to the public before being removed, often within minutes.

These short-lived misconfigurations can include Amazon RDS and DocumentDB snapshots, Amazon Machine Images (AMIs), and AWS Systems Manager (SSM) documents that contain sensitive organizational data.

ShutterGap Exposes Millions of Misconfigured AWS

According to research published on July 29, 2026, conventional Cloud Security Posture Management (CSPM) and Cloud-Native Application Protection Platform (CNAPP) products may fail to identify these exposures because they typically rely on periodic scans.

If a resource is made public and deleted between scan cycles, the misconfiguration may go undetected, leaving security teams unaware that data has been exposed.

Aryon’s analysis found that attackers can continuously enumerate publicly shared AWS resources and initiate access almost immediately after an exposure occurs.

Unlike defenders, who operate on scheduled assessments and remediation workflows, threat actors can automate monitoring and respond within seconds.

For publicly shared snapshots, an attacker may only need a brief window of time to initiate a copy operation into an AWS account they control. The copied snapshot can then be retained and examined after the original resource is no longer public.

The researchers observed frequent changes in the number of public RDS snapshots in the AWS us-east-1 region. During a 90-minute monitoring period, the public snapshot count changed 121 times, with six new exposures and six removals.

Aryon estimates that a substantial number of distinct resources may be publicly shared annually, even if only a small number are visible at any given moment.

Exposure-duration measurements highlight the severity of the issue. Aryon reported that 20% of publicly shared RDS snapshots appeared and disappeared in less than two minutes.

Additionally, 99% of deleted RDS and DocumentDB snapshots were removed within 30 minutes. These time frames are significantly shorter than the daily scan intervals used by many cloud-security platforms.

The company also analyzed a small sample of publicly exposed RDS snapshots and discovered AWS account identifiers, email addresses, patterns related to secrets, private keys, and potential payment card data.

The researchers emphasized that this is not an AWS vulnerability. AWS warns customers against placing sensitive data in publicly shared resources, but accidental configuration changes can still lead to immediate exposure of data to any AWS account.

The central issue, therefore, is prevention rather than detection. Organizations should implement AWS Service Control Policies (SCPs), encryption requirements, and AWS account-level public-sharing blocks to prevent risky configurations from being enabled.

For instance, the following SCP can prevent users from modifying RDS snapshot attributes, thereby blocking both public and private cross-account snapshot sharing:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyModifySnapshotAttributes",
      "Effect": "Deny",
      "Action": [
        "rds:ModifyDBSnapshotAttribute",
        "rds:ModifyDBClusterSnapshotAttribute"
      ],
      "Resource": "*"
    }
  ]
}

Organizations should carefully test this policy, as it can disrupt legitimate cross-account workflows. AWS customers should also enforce encryption for new RDS instances and clusters since encrypted snapshots cannot be publicly shared.

For AMIs, AWS provides an account-level Block Public Access setting that is enabled by default. Security teams can also use an SCP to prevent users from disabling this feature:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDisableImageBlockPublicAccess",
      "Effect": "Deny",
      "Action": "ec2:DisableImageBlockPublicAccess",
     "Resource": "*"
    }
  ]
}

The ShutterGap issue demonstrates that cloud exposure is no longer just a visibility problem. Since an attacker can discover and copy data in seconds, organizations need preventive guardrails to stop public sharing before a resource becomes accessible.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.