diff --git a/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml b/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml
index 42c3aa225..8d45fd949 100644
--- a/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml
+++ b/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml
@@ -1,8 +1,8 @@
 [metadata]
-creation_date = "2024/06/02"
+creation_date = "2025/06/02"
 integration = ["aws"]
 maturity = "production"
-updated_date = "2025/10/24"
+updated_date = "2025/12/18"
 
 [rule]
 author = ["Elastic"]
@@ -107,6 +107,7 @@ info where event.dataset == "aws.cloudtrail"
   and event.outcome == "success"
   and stringContains (aws.cloudtrail.request_parameters, "attributeType=CREATE_VOLUME_PERMISSION")
   and stringContains (aws.cloudtrail.request_parameters, "remove=")
+  and not source.address == "backup.amazonaws.com"
 '''
 
 [[rule.threat]]