ShutterGap: Aryon Security finds 3.7M AWS cloud resources exposed beyond CSPM/CNAPP visibility
Research from Aryon reveals that each year, 3,731,699 short-lived cloud resources containing highly sensitive information are publicly exposed. This impacts any organization using AWS services that support public sharing.
These exposures often last only minutes or hours, too briefly for periodically scanning CSPM and CNAPP platforms to detect, yet long enough for attackers to discover and copy them.

The findings expose a fundamental limitation of the reactive CSPM/CNAPP model: some cloud misconfigurations can be exploited before they can be detected and remediated. As AI-driven attack automation accelerates exploitation, this gap is becoming increasingly critical.
The research also demonstrates how organizations can prevent these exposures using resource-specific AWS Service Control Policies that block dangerous public-sharing configurations before they are created.
Why it’s important
- The attack is extremely easy to execute and can affect any organization
- Today’s cloud security model offers little to no protection against this type of attack. This is not an AWS vulnerability. Public-sharing settings are controlled by customers under the shared responsibility model. However, the research demonstrates that the traditional “find and remediate later” approach may offer little protection when the exposure can be exploited faster than it can be detected
- As AI-driven attack automation becomes more capable and adaptable, the time between misconfiguration and exploitation is likely to shrink further.
Who is potentially impacted
Any organization using AWS services that support public sharing. Large, multi-account cloud environments may face greater exposure because they create more resources, rely heavily on automation, and distribute cloud administration across many teams and business units.
What readers learn
Readers will learn how attackers can discover and copy short-lived publicly shared AWS resources, why traditional CSPM and CNAPP tools may miss these exposures, what sensitive data may be exposed, and how organizations can prevent the risk using resource-specific AWS Service Control Policies.
Service provider response
As AWS documentation makes clear, customers are responsible for ensuring that publicly shared resources do not contain sensitive data: “Make sure when sharing a snapshot as public that none of your private information is included in the public snapshot.”
Nevertheless, Aryon’s research identified a large volume of short-lived public exposures caused by customer misconfigurations that, according to a sample test, contains private information.