cis-aws-storage-2-5

name	cis-aws-storage-2.5
description	Ensure creating snapshots of EBS volumes
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","ebs","snapshot","backup","disaster-recovery","data-replication"]
cis_id	2.5
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-2.3","cis-aws-storage-2.4"]
prerequisites	["cis-aws-storage-2.1"]
severity_boost	{}

CIS Control 2.5: Ensure creating snapshots of EBS volumes (Manual)

Profile Applicability

• Level 2

Description

A snapshot is a backup of your EBS volume that captures its state at a specific point in time, storing only the data changes since the last snapshot to optimize storage costs and speed. Snapshots are crucial for data recovery, creating new EBS volumes, and replicating data across AWS regions for disaster recovery and high availability. Restoring from a snapshot allows you to create a new EBS volume and attach it to an EC2 instance in the same availability zone, ensuring data integrity and accessibility.

Rationale

The rationale behind using EBS snapshots is to ensure efficient and cost-effective data backup and recovery. By capturing only the data changes since the last snapshot, storage costs are minimized and the backup process is expedited. Snapshots are essential for maintaining data integrity, facilitating quick recovery, and enabling seamless data replication across regions, thereby enhancing disaster recovery capabilities and operational resilience.

Impact

Not utilizing EBS snapshots can lead to significant risks and drawbacks. Without snapshots, data recovery becomes more complex and time-consuming, increasing the risk of prolonged downtime in the event of data loss or system failure. Additionally, the absence of incremental backups can result in higher storage costs and inefficient use of resources. The lack of data replication across regions severely compromises disaster recovery efforts, making it challenging to maintain high availability and operational continuity. Overall, failing to use snapshots undermines data integrity, security, and the ability to quickly restore critical information.

Audit Procedure

Via AWS Management Console

To audit the use of EBS snapshots in AWS, follow these steps:

1. Access the AWS Management Console

   • Log in to your AWS account and navigate to the AWS Management Console

2. Review EBS Snapshots

   • Go to the EC2 Dashboard and select "Snapshots" under the "Elastic Block Store" section
   • Check the list of snapshots to ensure regular backups are being created for all critical volumes

3. Verify Snapshot Policies

   • Ensure that snapshot lifecycle policies are in place and configured correctly
   • Go to the "Lifecycle Manager" under the EC2 Dashboard and review policies for automated snapshot creation and retention

4. Check Snapshot Status and Details

   • Review the status of each snapshot to ensure they are completed successfully