cis-aws-storage-2-4

Ensure the creation of a new volume

Repositorio: CyberStrikeus/CyberStrike
Última actividad en el origen: 13 de abril de 2026 a las 04:22
Idioma detectado de SKILL.md: inglés
Estrellas: 1653
Forks: 254

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-storage-2-4

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

CIS Control 2.4: Ensure the creation of a new volume (Manual)

Profile Applicability

Level 2

Description

Leave the root volume unchanged and create a new volume. To ensure the security of the instance and prevent data loss, select "no" under the "delete on termination" option and encrypt your volume using AWS KMS. A default key is available for encrypting the volume.

Rationale

By leaving the root volume unchanged and creating a new volume, you separate critical data from the operating system. Selecting "no" for the "delete on termination" option ensures that data on the new volume is not automatically deleted when the instance is terminated, protecting against accidental data loss. Encrypting the volume using AWS KMS adds an additional layer of security, safeguarding the data against unauthorized access. The use of a default key for encryption simplifies the process while maintaining strong security measures.

Impact

Not following these steps can lead to data loss, security risks, operational disruptions, and prolonged recovery times. Setting "delete on termination" to "no" prevents data deletion upon instance termination, while encrypting the volume with AWS KMS protects against unauthorized access. Storing critical data separately from the root volume ensures operational continuity and easier recovery.

Audit Procedure

Via AWS Management Console

To audit this configuration in AWS, follow these steps:

Access the AWS Management Console
- Log in to your AWS account and navigate to the AWS Management Console
Review EBS Volumes
- Go to the EC2 Dashboard and select "Volumes" under the "Elastic Block Store" section
- Check the properties of each volume to ensure that the root volume is unchanged and new volumes are created as needed
Check "Delete on Termination" Setting
- In the "Volumes" section, select each volume and click on the "Actions" button
- Select "Modify Volume" and ensure that "Delete on Termination" is set to "no" for the critical volumes
Verify Encryption
- In the "Volumes" section, check the "Encrypted" column to confirm that the volumes are encrypted
- For detailed information, select a volume and view its details to ensure it is encrypted using AWS KMS
Review IAM Policies
- Navigate to the IAM Dashboard and review the policies attached to users, groups, and roles to ensure they have appropriate permissions to create, modify, and encrypt EBS volumes
Use AWS Config
- Enable AWS Config to continuously monitor and record AWS resource configurations
- Create AWS Config rules to check for compliance with best practices, such as ensuring volumes are encrypted and "Delete on Termination" is set to "no"
Generate Reports
- Use AWS CloudTrail to review logs of API calls made to EBS volumes, ensuring compliance with the required configurations
- Generate compliance reports using AWS Config and AWS CloudTrail to provide evidence of adherence to best practices

Via AWS CLI

# Check EBS volumes and their delete on termination status
aws ec2 describe-instances \
  --query 'Reservations[].Instances[].[InstanceId,BlockDeviceMappings[]]' \
  --output json

# Check for volumes with DeleteOnTermination=true
aws ec2 describe-instances \
  --query 'Reservations[].Instances[].BlockDeviceMappings[?Ebs.DeleteOnTermination==`true`]' \
  --output json

# Verify encryption status
aws ec2 describe-volumes \
  --query 'Volumes[].[VolumeId,Encrypted,KmsKeyId]' \
  --output table

# Check specific volume configuration
aws ec2 describe-volumes --volume-ids vol-xxxxxxxxx

Expected Result

Root volume remains unmodified
Additional data volumes are created separately
Delete on Termination is set to "no" for data volumes
Volumes containing sensitive data are encrypted with AWS KMS
KMS keys are properly configured and rotated

Remediation

Via AWS Management Console

Volume Configurations
- After configuring your volume, ensure the settings meet your requirements
- To secure your file system and prevent data loss, verify that the "Delete on Termination" option is set to "no," the volume is encrypted, and the KMS key is correctly specified
- For this EBS instance, we are using the default KMS key
Availability Zone Consistency
- Ensure your EBS volume is in the same Availability Zone as your EC2 instance
- An EBS volume can only be attached to an EC2 instance within the same Availability Zone
- You can mount and unmount EBS volumes to any EC2 instance within the same zone as needed

Via AWS CLI

# Modify instance attribute to disable DeleteOnTermination
aws ec2 modify-instance-attribute \
  --instance-id i-xxxxxxxxx \
  --block-device-mappings '[{
    "DeviceName": "/dev/sdf",
    "Ebs": {
      "DeleteOnTermination": false
    }
  }]'

# Create a new encrypted volume
aws ec2 create-volume \
  --volume-type gp3 \
  --size 100 \
  --encrypted \
  --kms-key-id arn:aws:kms:region:account:key/key-id \
  --availability-zone us-east-1a

# Attach volume to instance
aws ec2 attach-volume \
  --volume-id vol-xxxxxxxxx \
  --instance-id i-xxxxxxxxx \
  --device /dev/sdf

Default Value

By default, root volumes have DeleteOnTermination set to true, while additional volumes have it set to false. Encryption is not enabled by default.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure	●	●	●
v7	11.1 Maintain Standard Security Configurations for Network Devices		●	●

Notes

This is a manual control requiring configuration review
By following these steps, you can effectively audit your EBS configurations to ensure data security, integrity, and operational reliability
Always create separate volumes for data that needs to persist beyond instance lifecycle
Use AWS Config rules to automatically detect non-compliant configurations
Document the purpose and data classification of each volume

name	cis-aws-storage-2.4
description	Ensure the creation of a new volume
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","ebs","encryption","kms","data-protection","delete-on-termination"]
cis_id	2.4
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack

name	cis-aws-storage-2.4
description	Ensure the creation of a new volume
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","ebs","encryption","kms","data-protection","delete-on-termination"]
cis_id	2.4
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack

cis-aws-storage-2-4

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

CIS Control 2.4: Ensure the creation of a new volume (Manual)

Profile Applicability

Description

Rationale

Impact

Audit Procedure

Via AWS Management Console

Via AWS CLI

Expected Result

Remediation

Via AWS Management Console

Via AWS CLI

Default Value

References

CIS Controls

Notes