cis-aws-storage-6-2

name	cis-aws-storage-6.2
description	Ensure AWS Disaster Recovery Configuration
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","edr","disaster-recovery","network","architecture","vpc","replication"]
cis_id	6.2
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-6.1","cis-aws-storage-6.3","cis-aws-storage-6.4"]
prerequisites	[]
severity_boost	{}

CIS 6.2: Ensure AWS Disaster Recovery Configuration (Manual)

Profile Applicability

• Level: 2

Description

It's important to understand how the network on EDR works. This isn't a simple service to configure, but it works with multiple work loads over the network. You can connect your on-premises or third-party cloud service to AWS EDR over the network.

AWS Network Architecture for EDR:

1. Local Network Connection:

   • Connect an AWS Replication Agent to each of your resources in your local network inside the data center or cloud.

2. AWS Cloud Architecture:

   • Choose the AWS Region that you want to house your disaster recovery instances.
   • Create AWS API Endpoints for EC2, Disaster Recovery, and S3.
   • Upon creation of Disaster Recovery endpoints, two subnets will be created in your VPC:
     • Staging Area Subnets: Replication servers with EBS volumes attached to each disk on the servers.
     • Recovery Subnets: Recovery EC2 instances attached to EBS volumes.

3. Network Connectivity:

   • Connect local network over TCP port 443 to EDR and S3.
   • Connect local replication agent to AWS replication servers over TCP port 1500.
   • Connectivity out of staging area: Connect staging area on AWS to EDR over TCP port 443.
   • Allow connection to S3 over TCP 443.
   • Allow connectivity to EC2 over TCP 443 to connect to API Endpoint.

Rationale

Understanding the network architecture is essential for proper EDR implementation. The network configuration ensures secure, reliable data replication between on-premises or third-party cloud environments and AWS, enabling effective disaster recovery capabilities.

Impact

Proper network configuration requires careful planning of VPC architecture, subnet design, security group rules, and network connectivity. Organizations must ensure adequate bandwidth and network security controls are in place.

Audit Procedure

This control focuses on understanding and documenting the network architecture. Verification should include:

• Reviewing VPC configuration for EDR endpoints
• Confirming staging and recovery subnets are properly configured
• Verifying security group rules allow required ports (TCP 443, TCP 1500)
• Ensuring network connectivity between on-premises and AWS
• Validating replication agent network access