cis-aws-storage-3-3

name	cis-aws-storage-3.3
description	Ensure EFS and VPC Integration for redundancy and scalability
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","efs","vpc","ec2","redundancy","scalability","availability"]
cis_id	3.3
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-3.1","cis-aws-storage-3.2","cis-aws-storage-3.7"]
prerequisites	[]
severity_boost	{}

3.3 Ensure EFS and VPC Integration (Manual)

Profile Applicability

• Level 2

Description

You can use EFS as a network file system across availability zones on a virtual private cloud. This capability allows the organization to create a highly available file sharing solution. Leveraging AWS VPC and EC2 in tandem with AWS EFS makes for a highly available and scalable cloud file storage solution.

Rationale

Redundancy and scalability are crucial for maintaining uninterrupted services. By integrating these AWS services, users can harness the full power of AWS, ensuring a resilient and scalable infrastructure.

Impact

Not integrating AWS services for redundancy and scalability can lead to service disruptions and increased downtime. This approach also limits your ability to efficiently handle growing workloads, negatively impacting performance and user experience.

Audit Procedure

Audit Procedures for AWS Redundancy and Scalability

1. Create Mount Targets in Each Availability Zone: Ensure EFS is attached in each availability zone by creating mount targets in each subnet. Although multiple subnets can exist per availability zone, verify that EFS is configured to work with one subnet per zone to maintain redundancy.

2. Monitor EFS with CloudWatch: Use AWS CloudWatch to automatically monitor your EFS service. Check that alarms are configured and logs and events are tracked effectively, providing real-time insights into the performance and health of your file systems.

Expected Result

• Mount targets should exist in each availability zone
• EFS should be configured for high availability across multiple subnets
• CloudWatch monitoring should be enabled with appropriate alarms configured

Remediation

Console

Create an EC2 instance in each availability zone within your VPC.

Default Value

By default, AWS does not automatically create mount targets in all availability zones. Users must explicitly configure EFS mount targets for each desired availability zone to ensure redundancy.

References

1. https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html#how-it-works-conceptual

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8