cis-aws-storage-2-3

name	cis-aws-storage-2.3
description	Ensure the proper configuration of EBS storage
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","ebs","encryption","kms","volume-configuration"]
cis_id	2.3
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	["CWE-311"]
chains_with	["cis-aws-storage-2.1","cis-aws-storage-2.4","cis-aws-storage-2.5"]
prerequisites	["cis-aws-storage-2.1"]
severity_boost	{}

CIS Control 2.3: Ensure the proper configuration of EBS storage (Manual)

Profile Applicability

• Level 2

Description

All computer instances need to have a device on which to store files. EBS is built on top of EC2 instances as a block storage device.

Rationale

Remember that we are working with cloud computing. Rather than purchasing and manually installing disk drives on a server, AWS allows you to virtually add storage using Elastic Block Store (EBS).

Proper EBS configuration is essential for:

• Data integrity and persistence
• Performance optimization
• Cost-effectiveness
• Security (encryption)
• Disaster recovery capability
• Operational reliability

Impact

Failure to properly configure EBS storage can lead to data loss, performance issues, increased costs, security vulnerabilities, and operational downtime. Ensuring correct configuration is crucial to maintain data integrity, efficiency, cost-effectiveness, security, and reliability.

Audit Procedure

Via AWS Management Console

1. Open the Amazon EC2 Console

   • Navigate to the EC2 Dashboard in the AWS Management Console

2. Select Volumes

   • Under the "Elastic Block Store" section, select "Volumes"

3. Create Volume

   • Click on "Create Volume"
   • Choose the volume type (e.g., General Purpose SSD (gp2), Provisioned IOPS SSD (io1), etc.)
   • Specify the size and availability zone
   • Optionally, configure additional settings such as IOPS, encryption, and tags

4. Attach Volume to Instance

   • Select the volume you created
   • Click on "Actions" and choose "Attach Volume"
   • Select the instance to which you want to attach the volume and specify the device name

5. Format and Mount the Volume (on the instance)

   • Connect to your instance using SSH
   • List available disks using the command: lsblk
   • Format the new volume (e.g., sudo mkfs -t ext4 /dev/xvdf for ext4 filesystem)
   • Create a mount point (e.g., sudo mkdir /mnt/data)
   • Mount the volume (e.g., sudo mount /dev/xvdf /mnt/data)