cis-aws-storage-4-8

name	cis-aws-storage-4.8
description	Ensure exporting cache to S3
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","fsx","s3","data-export","backup","level-2"]
cis_id	4.8
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws","linux"]
cwe_ids	[]
chains_with	["cis-aws-storage-4.3","cis-aws-storage-4.7","cis-aws-storage-5.1"]
prerequisites	["cis-aws-storage-4.3","cis-aws-storage-4.7"]
severity_boost	{}

4.8 Ensure exporting cache to S3 (Manual)

Profile Applicability

• Level 2

Description

The S3 bucket we created earlier will store the files generated at this mount point.

Rationale

The rationale behind using the S3 bucket to store files generated at the mount point is to ensure scalable, durable, and cost-effective storage for your data. By exporting files to S3, you benefit from its high availability and robust data management features, which enhances data security and accessibility. This approach also optimizes storage resource utilization and simplifies data backup and retrieval processes.

Impact

Without exporting cache data to S3, files created in the cache mount point will not be persisted to durable storage. This can result in data loss when the cache is deleted or during cache failures, as FSx File Cache is designed as a temporary high-performance layer, not long-term storage.

Audit Procedure

SSH to EC2 Instance

1. Connect to your EC2 instance:

ssh -i "{KEY.pem}" ubuntu@{your-ec2-instance}

2. Verify mount point has files:

ls -la /mnt

3. Check S3 bucket for exported data:

# Use AWS CLI to list objects in the S3 bucket
aws s3 ls s3://<bucket-name>/<prefix>/ --recursive

# Check for specific test files
aws s3 ls s3://<bucket-name>/<prefix>/efx.txt

AWS Console

1. Navigate to the Amazon S3 console
2. Select the bucket associated with your FSx cache
3. Navigate to the prefix/folder path configured in the Data Repository Association
4. Verify that files created in the cache mount point are present in S3

Expected Result

Files created in the FSx cache mount point should be automatically exported to the S3 bucket through the Data Repository Association. The S3 bucket should contain the files with proper metadata and timestamps.

Remediation

SSH to EC2 Instance

We can export the files that were created to the S3 bucket using the following steps:

1. Create a file on the FSx mount point:

  efx.txt