Oops, I Leaked It Again - How We Found PII in Exposed RDS Snapshots

Amazon RDS simplifies the management of relational databases (e.g., MySQL, PostgreSQL) in the AWS cloud. Our research found monthly exposure of numerous databases with significant Personally Identifiable Information (PII) leakage. This lecture delves into RDS snapshots and the inadvertent exposure of sensitive data. We describe our automated process for detecting PII in publicly shared snapshots. Additionally, we offer recommendations for preventing, detecting, and remediating the risks associated with accidental public sharing of RDS snapshots.

SANS CloudSecNext Summit 2023
Oops, I …

amazon amazon rds aws aws cloud cloud data databases exposed exposure found information leaked management mysql personally identifiable information pii postgresql rds relational databases research sensitive sensitive data snapshots