Techniques for circumventing provider-imposed limitations in snapshot inspection of disks for cybersecurity

A non-transitory computer-readable medium storing a set of instructions for reducing use of restricted operations in a cloud computing environment during cybersecurity threat inspection, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• detect an encrypted disk in a cloud computing environment, the encrypted disk encrypted utilizing a first key in a key management system (KMS);
• generate a second key in the KMS, the second key providing access for a principal of an inspection environment;
• generate a snapshot of the encrypted disk;
• generate a volume based on the snapshot of the encrypted disk, wherein the volume is re-encrypted with the second key;
• generate a snapshot of the re-encrypted volume;
• generate an inspectable disk from the snapshot of the re-encrypted volume;
• and
• initiate inspection for a cybersecurity object on the inspectable disk.

A system for reducing use of restricted operations in a cloud computing environment during cybersecurity threat inspection comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• detect an encrypted disk in a cloud computing environment, the encrypted disk encrypted utilizing a first key in a key management system (KMS);
• generate a second key in the KMS, the second key providing access for a principal of an inspection environment;
• generate a snapshot of the encrypted disk;
• generate a volume based on the snapshot of the encrypted disk, wherein the volume is re-encrypted with the second key;
• generate a snapshot of the re-encrypted volume;
• generate an inspectable disk from the snapshot of the re-encrypted volume;
• and
• initiate inspection for a cybersecurity object on the inspectable disk.