cis-aws-storage-2-1

name	cis-aws-storage-2.1
description	Ensure creating EC2 instance with EBS
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","ebs","ec2","block-storage","encryption"]
cis_id	2.1
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-2.2","cis-aws-storage-2.3","cis-aws-storage-2.4","cis-aws-storage-2.5"]
prerequisites	[]
severity_boost	{}

CIS Control 2.1: Ensure creating EC2 instance with EBS (Manual)

Profile Applicability

• Level 2

Description

EBS are storage volumes that you attach to Amazon EC2 instances. After you attach a volume to an instance, you can use it in the same way you would use a local hard drive attached to a computer, for example to store files or to install applications.

Rationale

Amazon EBS (Elastic Block Store) provides persistent block-level storage for EC2 instances, which is essential for:

• Data persistence beyond instance lifecycle
• Ability to detach and reattach volumes to different instances
• Snapshot capability for backup and disaster recovery
• Flexible volume types optimized for different workloads (SSD, HDD)
• Encryption support for data at rest

Properly configuring EC2 instances with EBS ensures data availability, durability, and security.

Impact

Not properly creating EC2 instances with EBS volumes can lead to:

• Data loss when instances are terminated
• Inability to backup instance data through snapshots
• Performance issues if using instance storage instead of optimized EBS volumes
• Difficulty migrating data between instances
• Lack of encryption for sensitive data at rest

Audit Procedure

Via AWS Management Console

Creating EC2 instance with Volume:

To create an EC2 instance with a volume in AWS, you can follow these general steps:

1. Initializing a Secure EC2 Instance

   • Navigate to the EC2 dashboard within your AWS console. Make sure you're in the region that's right for you
   • Select "Launch Instance"

2. Naming the EC2 instance

   • Name your EC2 instance according to the proper naming convention set by your organization

3. Configure the operating system

   • You can choose any operating system according to your needs. In this tutorial, Ubuntu is the OS of choice

4. Create a key pair

   • Next, create a key pair. You will need this to login your EC2 instance. We're going to log in via SSH
   • Select "Create new key pair". Give your key a name, select RSA encryption, and select Open SSH
   • As you can see by the prompt, you will need to keep the private key that's generated secure on your local computer. This is how you will access your EC2 instance. Select "Create key pair" your secret key will start downloading as a ".pem" file