cis-aws-storage-6-11

name	cis-aws-storage-6.11
description	Ensure execution of a failback
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","edr","disaster-recovery","failback","recovery","restoration"]
cis_id	6.11
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-6.10","cis-aws-storage-6.9"]
prerequisites	[]
severity_boost	{}

CIS 6.11: Ensure execution of a failback (Manual)

Profile Applicability

• Level: 2

Description

This method involves transitioning operations back from the backup or recovery system to the primary system after the resolution of a disruption or disaster. You can execute a failback either to the original server, ensuring continuity and restoring the previous state, or to a new server, which might be necessary if the original server is compromised or no longer functional. The failback process ensures that all updated data and configurations are transferred back, maintaining the integrity and functionality of the primary system.

Rationale

A failback is crucial for restoring normal operations after a disaster recovery scenario. Transitioning operations back to the primary system ensures continuity and leverages the original environment's configurations and settings. This process can be directed either to the original server, maintaining the existing infrastructure, or to a new server if the original is compromised. Ensuring all data and configurations are accurately transferred back preserves system integrity and functionality, reducing downtime and allowing the organization to resume normal operations efficiently.

Impact

Failback operations require:

• Completion of disaster resolution
• Verification that primary environment is ready
• Failback client ISO installation
• Data synchronization between recovery and primary
• Potential brief service interruption
• Post-failback validation

Prerequisites:

• Volumes on server being failed back to must be same size or larger than recovery instance
• Failback client must have proper IAM permissions
• Network connectivity (TCP 1500 inbound, TCP 443 outbound)
• Public IP added to recovery instance

Audit Procedure

Via AWS Console

Performing the failback:

1. Download Failback Client ISO:

   • Download the failback client ISO

2. Attach ISO and Boot:

   • Attach the ISO to your original server and boot up the server.
   • The failback client will prompt for the IAM access key and secret key generated when making the user with the permission to access the failback.
   • It will also ask for the recovery instance. Remember: regions are case sensitive. If you're in US east 1, type "us-east-1."

3. Select Target Server:

   • If you are failing back to the original server, the failback client will automatically detect the recovery instance and map the data volumes for replication.