Cloud ShutterGap: Millions of AWS Resources Briefly Exposed, Undetected by CSPM

New research from Aryon exposes a critical blind spot in cloud security tooling: millions of AWS resources are being publicly exposed for mere minutes, long enough for attackers to strike but too brief for traditional scanning tools to catch.

The findings challenge a foundational assumption in cloud security: that defenders have a reasonable window between detection and exploitation.

Aryon’s research, published July 29, 2026, shows that window has effectively vanished for a significant class of cloud misconfigurations.

Cloud ShutterGap

CSPM and CNAPP platforms operate on a simple premise: scan periodically, flag risky configurations, and give security teams time to remediate before attackers find them. That model assumes exposures persist long enough to be caught in a scan cycle, often every 24 hours.

Aryon’s researchers, Ariel Litmanovich, Tom Tsabar, and Ido Dar, discovered that the assumption breaks down for ephemeral public-sharing misconfigurations.

By continuously monitoring AWS resources like RDS snapshots, DocumentDB snapshots, AMIs, and SSM documents, they found a churn pattern invisible to standard tools: resources going public and then private again within minutes.

In one documented 90-minute window, the count of public RDS snapshots in $us\text{-}east\text{-}1$ us-east-1 changed 12 times: six creations, six deletions.

Some snapshots existed publicly for less than two minutes. Nearly 99% of exposed RDS and DocumentDB snapshots that were later deleted disappeared within 30 minutes of creation.

The research highlights a critical asymmetry: attackers don’t need to exfiltrate data during the exposure window; they only need enough time to initiate a copy operation.

Once a snapshot is copied into an attacker-controlled AWS account, the original exposure can vanish, but the stolen data remains fully accessible for offline analysis.

Aryon demonstrated this with a simple automated workflow, using commands like aws rds restore-db-instance-from-db-snapshot to restore, dump, and scan captured snapshots for sensitive data.

To validate real-world impact, researchers built an extraction pipeline and tested it against 24 publicly shared RDS snapshots. Every single one contained AWS account IDs.

Using TruffleHog and custom detection patterns, the team also uncovered secrets, email addresses, private keys, and other sensitive data, confirming that these aren’t theoretical exposures but active data leaks.

“The old model assumed defenders had a fighting chance between detection and exploitation. AI-driven, continuous attacker scanning has erased that gap now the only viable defense is prevention, not faster detection.” Aryon Research Team.

The report ties this shift partly to advances in offensive automation. Specialized security-focused AI models and agentic attack frameworks referenced in recent work from Palo Alto Networks’ Unit 42 and CrowdStrike’s 2026.

Global Threat Report are making real-time exploitation of transient misconfigurations far more feasible than the manual reconnaissance techniques of just a few years ago.

Mitigation

Aryon’s core recommendation is a shift toward preventive controls rather than reactive scanning. Key mitigations include:

Deploy Service Control Policies (SCPs) to block rds:ModifyDBSnapshotAttribute and rds:ModifyDBClusterSnapshotAttribute actions outright.
Enforce storage encryption at rest for new RDS/DocumentDB instances, since encrypted snapshots cannot be shared publicly.
Lock AWS’s default AMI public-access block using an SCP denying ec2:DisableImageBlockPublicAccess.
Enable and lock the SSM document public-sharing block via ssm:UpdateServiceSetting restrictions.
Audit CloudTrail logs over the past 90 days for ModifyDBSnapshotAttribute, ModifyImageAttribute, and ModifyDocumentPermission events to assess historical exposure.

This research builds on earlier findings from Mitiga regarding exposed RDS snapshots but reaches a starkly different conclusion on remedy.

Where detection-focused research typically recommends better monitoring, Aryon argues that ephemeral exposures render monitoring alone insufficient; prevention through hardened, well-tuned guardrails is the only durable defense against attack windows measured in minutes, not hours.