SharedSnapshotCopyInitiated
AWS
SharedSnapshotCopyInitiated
Event
Records the start of a copy operation for an EBS snapshot shared from another AWS account.
Security Context
- Accessing cloud storage objects can expose sensitive data including backups, configuration files, application data, and customer information.
- Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.
Log Source
CloudTrail
Sample Event
SharedSnapshotCopyInitiated fires in Fantastic Logs’s own (victim’s) CloudTrail when Draco — operating from his external account 555666661337 — copies the shared snapshot snap-0phoenix000000007. The snapshot was made shareable earlier via ModifySnapshotAttribute. Because the snapshot owner is the receiving party of this audit event, userIdentity.type is AWSAccount (the trail only sees account-level identity, not the consuming account’s user details), recipientAccountId is the victim, and userIdentity.accountId is the adversary’s account. T1537 + T1530.
{ "eventVersion": "1.09", "userIdentity": { "type": "AWSAccount", "principalId": "AROADRAC0EXTERNAL666", "accountId": "555666661337", "invokedBy": "AWS Internal" }, "eventTime": "2026-04-15T20:38:54Z", "eventSource": "ec2.amazonaws.com", "eventName": "SharedSnapshotCopyInitiated", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "serviceEventDetails": { "snapshotId": "snap-0phoenix000000007", "source": "555666661337", "destination": "555123456789" }, "eventID": "90000000-0000-4000-8000-000110101111", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Exfiltration Collection
Techniques:
- T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
- T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage.