steampipe plugin install awssteampipe plugin install aws

Table: aws_ebs_snapshot

An EBS snapshot is a point-in-time copy of Amazon EBS volume, which is copied to Amazon Simple Storage Service.

The aws_ebs_snapshot table lists all private snapshots by default.

You can specify an owner alias, owner ID or snapshot ID in the where clause (where owner_alias=''), (where owner_id='') or (where snapshot_id='') to list public or shared snapshots from a specific AWS account.

Examples

List of snapshots which are not encrypted

select
  snapshot_id,
  arn,
  encrypted
from
  aws_ebs_snapshot
where
  not encrypted;

List of EBS snapshots which are publicly accessible

select
  snapshot_id,
  arn,
  volume_id,
  perm ->> 'UserId' as userid,
  perm ->> 'Group' as group
from
  aws_ebs_snapshot
  cross join jsonb_array_elements(create_volume_permissions) as perm
where
  perm ->> 'Group' = 'all';

Find the Account IDs with which the snapshots are shared

select
  snapshot_id,
  volume_id,
  perm ->> 'UserId' as account_ids
from
  aws_ebs_snapshot
  cross join jsonb_array_elements(create_volume_permissions) as perm;

Find the snapshot count per volume

select
  volume_id,
  count(snapshot_id) as snapshot_id
from
  aws_ebs_snapshot
group by
  volume_id;

List snapshots owned by a specific AWS account

select
  snapshot_id,
  arn,
  encrypted,
  owner_id
from
  aws_ebs_snapshot
where
  owner_id = '859788737657';

Get a specific snapshot by ID

select
  snapshot_id,
  arn,
  encrypted,
  owner_id
from
  aws_ebs_snapshot
where
  snapshot_id = 'snap-07bf4f91353ad71ae';

List snapshots owned by Amazon (Note: This will attempt to list ALL public snapshots)

select
  snapshot_id,
  arn,
  encrypted,
  owner_id
from
  aws_ebs_snapshot
where
  owner_alias = 'amazon'

Query examples

Control examples

.inspect aws_ebs_snapshot

AWS EBS Snapshot

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) specifying the snapshot.
create_volume_permissions	jsonb	The users and groups that have the permissions for creating volumes from the snapshot.
data_encryption_key_id	text	The data encryption key identifier for the snapshot. This value is a unique identifier that corresponds to the data encryption key that was used to encrypt the original volume or snapshot copy. Because data encryption keys are inherited by volumes created from snapshots, and vice versa, if snapshots share the same data encryption key identifier, then they belong to the same volume/snapshot lineage.
description	text	The description for the snapshot.
encrypted	boolean	Indicates whether the snapshot is encrypted.
kms_key_id	text	The Amazon Resource Name (ARN) of the AWS Key Management Service (AWS KMS) customer master key (CMK) that was used to protect the volume encryption key for the parent volume.
owner_alias	text	The AWS owner alias, from an Amazon-maintained list (amazon). This is not the user-configured AWS account alias set using the IAM console.
owner_id	text	The AWS account ID of the EBS snapshot owner.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
progress	text	The progress of the snapshot, as a percentage.
region	text	The AWS Region in which the resource is located.
snapshot_id	text	The ID of the snapshot. Each snapshot receives a unique identifier when it is created.
start_time	timestamp with time zone	The time stamp when the snapshot was initiated.
state	text	The snapshot state.
state_message	text	Encrypted Amazon EBS snapshots are copied asynchronously. If a snapshot copy operation fails this field displays error state details to help you diagnose why the error occurred.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags assigned to the snapshot.
title	text	Title of the resource.
volume_id	text	The ID of the volume that was used to create the snapshot. Snapshots created by the CopySnapshot action have an arbitrary volume ID that should not be used for any purpose.
volume_size	bigint	The size of the volume, in GiB.

turbot/aws