cis-aws-storage-4-4

name	cis-aws-storage-4.4
description	Ensure the creation of Elastic File Cache
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","fsx","file-cache","cache-creation","vpc","kms","level-2"]
cis_id	4.4
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-4.1","cis-aws-storage-4.2","cis-aws-storage-4.3","cis-aws-storage-4.5"]
prerequisites	["cis-aws-storage-4.2","cis-aws-storage-4.3"]
severity_boost	{}

4.4 Ensure the creation of Elastic File Cache (Manual)

Profile Applicability

• Level 2

Description

With the prerequisites completed, we can now proceed to create our Elastic File Cache.

Rationale

By implementing an Elastic File Cache, frequently accessed data is stored closer to the application, reducing latency and speeding up access times. This approach optimizes resource utilization, improves user experience, and ensures that the system can handle high-demand workloads effectively.

Impact

Without implementing Elastic File Cache, applications may experience higher latency, slower data access times, and reduced performance, particularly for frequently accessed data. This can negatively impact user experience and system efficiency.

Audit Procedure

AWS Console

1. Navigate to the AWS Elastic File Cache console: https://console.aws.amazon.com/fsx/
2. Click the hamburger menu on the left side of the screen and select "caches"
3. Review existing File Cache configurations
4. Verify the following for each cache:
   • Cache name is descriptive and follows naming conventions
   • Storage capacity is appropriately sized (should be in increments of 1.2 TiB)
   • Throughput capacity is calculated correctly based on storage (multiply cache storage capacity by throughput tier)
   • VPC configuration is correct and uses the appropriate VPC
   • Security groups are properly configured
   • Subnet selection is appropriate
   • Encryption is enabled using aws/fsx KMS encryption keys
   • Data repository associations (DRAs) are properly configured
   • Cache is linked to the correct S3 bucket path

AWS CLI

# List all File Caches
aws fsx describe-file-caches --query 'FileCaches[].[FileCacheId,FileCachePath,Lifecycle,StorageCapacity]' --output table

# Describe a specific File Cache
aws fsx describe-file-caches --file-cache-ids <cache-id>

# Check Data Repository Associations
aws fsx describe-data-repository-associations --filters Name=file-cache-id,Values=<cache-id>

Expected Result

Elastic File Cache should be properly created and configured with:

• Appropriate storage capacity (in 1.2 TiB increments)
• Correctly calculated throughput capacity
• Proper VPC and security group configuration
• KMS encryption enabled