Paco Hope #resist<p>Amazon has this leadership principle of "Learn and Be Curious" which is all about wanting to know things and enjoying learning new things. I have my own version of this called "Learn and Be Furious." Every once in a while I have to learn how something works, and once I get in there and figure it out, I'm shaking my fist at the screen asking "<em>why did they DO it this way</em>!?"</p><p>In <a href="https://infosec.exchange/tags/AWS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AWS</span></a> EBS volumes are the virtual hard disks on EC2 instances, and EBS volumes can have snapshots. Snapshots are often used for backup/recovery and lots of other important uses, so there is a way to "lock" a snapshot. This prevents it being deleted accidentally. Yesterday I had to learn how to work with locked snapshots.</p><p>Here's what I learned.</p><p><strong>The API</strong></p><p>How do you lock a snapshot? There's an <a href="https://infosec.exchange/tags/EC2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>EC2</span></a> <code>modify-snapshot-attribute</code> API, but "locked" is not a snapshot attribute. You can't lock it that way. Snapshot <code>attributes</code> are actually mainly permissions. It allows some folks to see, and thereby launch instances from, the snapshot. This is how, say, the Debian team or the FreeBSD team make an AMI that you can launch in EC2. They make an EC2 instance, make a snapshot of its EBS volume, set its snapshot public, and do some other things that make it available. So <code>attributes</code> aren't really "attributes" in some general sense: they're permissions.</p><p>If you want to lock a snapshot there's a <code>lock-snapshot</code> API. That's all it's good for: locking snapshots. If you want to unlock one, you guessed it: different API: <code>unlock-snapshot</code>.</p><p>This isn't exactly bad. Generally speaking, AWS APIs are <code>service:verb-noun</code>. So <code>ec2:lock-snapshot</code> fits the idiom and the common pattern. But by that logic, you'd expect <code>ec2:share-snapshot</code> and <code>ec2:unshare-snapshot</code> instead of <code>ec2:modify-snapshot-attributes</code> with <code>user: all</code>. </p><p><strong>Why so furious?</strong></p><p>I'm writing a janitor job that finds orphaned snapshots and deletes them. But if the snapshot is locked, trying to delete it throws an exception.</p><p>There are obviously 2 ways to do this: try it anyway and catch the exception when the snapshot is locked and deal with it. Or, I can figure out which snapshots are locked, and don't try to delete them in the first place.</p><p>I'm doing the latter, because I guess I want exceptions to be thrown only on failures. I don't want the janitor to run into something I did on purpose (locking a snapshot), and then figure it out down in the exception handler. I guess this is just what I think is the right way to do it, and maybe I'm wrong.</p><p><strong>How do I find locked snapshots?</strong></p><p>You'd think that you could call <code>describe-snapshots</code>, which takes certain <code>Filters</code>. There's a lot of <a href="https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSnapshots.html" rel="nofollow noopener noreferrer" target="_blank">possible things to filter on</a>. I can get it to filter down to a certain set of snapshots based on a few criteria. Locked state is not one of them. In fact, the status of the lock is not returned in the information you get from <code>describe-snapshots</code>. If you wanted to know about <strong>locked</strong> snapshots, you should have called <code>describe-locked-snapshots</code>, which will return just those.</p><p><strong>What about the list of unlocked snapshots?</strong></p><p>If I have a list of snapshots (say, a list of orphans that should be deleted), but I want to figure out which ones are <strong>not</strong> locked, how do I do that?</p><p>First I get the list of <strong>all</strong> snapshots (or in my case, all orphaned snapshots). Then I get the list of <strong>all locked</strong> snapshots. Then I do the diff to remove locked snapshots from the list of all snapshots.</p><p>This feels like what my niece would call <em>wonker bonkers</em>. I dunno. Maybe my expectations are all wrong.</p>