cis-aws-euc-2-14

name	cis-aws-euc-2.14
description	Ensure WorkSpaces that are not being utilized are removed
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","resource-management","unused-resources"]
cis_id	2.14
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure WorkSpaces that are not being utilized are removed (Automated)

Description

Identify and remove any WorkSpace instances available within your AWS account that are not being utilized.

Rationale

An AWS WorkSpaces instance is considered unused if has 0 (zero) known user connections registered within the past 30 days.

Impact

None

Audit Procedure

Using AWS Console

Perform the following to ensure WorkSpaces not being utilized have been removed.

1. Log in to the WorkSpaces dashboard at https://console.aws.amazon.com/workspaces/
2. In the left panel click WorkSpaces
3. Choose the WorkSpaces instance that you want to examine.
4. Click on WorkSpace id link.
   • Verify the User Last Active attribute value is less than 30 days old
5. Repeat step 4 to verify the last user login, returned by the User Last Active attribute value, for all WorkSpaces.
6. Change the AWS region and repeat the audit process for other regions.

If the User Last Active was registered more than 30 days ago (e.g. Feb 16, 2017 10:32:54 UTC), the selected WorkSpaces instance is not in use anymore and can be safely removed from your AWS account. Refer to the remediation procedure below.

Using AWS CLI

1. Run the describe-workspaces command to list the IDs of all WorkSpaces instances available within the selected region:

aws workspaces describe-workspaces \
    --region us-east-1 \
    --output table \
    --query 'Workspaces[*].WorkspaceId'

2. The command should return a table with the requested WorkSpaces IDs:

+-------------------+
|DescribeWorkspaces|
+-------------------+
|  ws-7cgsl2k65     |
|  ws-8d6il5kr3     |
|  ws-2dtyllq47     |
+-------------------+

3. Run the describe-workspaces-connection-status command using the ID of the WorkSpaces instance in the table output:

aws workspaces describe-workspaces-connection-status \
    --region us-east-1 \
    --workspace-ids ws-7cgsl2k65 \
    --query \
'WorkspacesConnectionStatus[*].LastKnownUserConnectionTimestamp'

4. The command should return the timestamp of the User last active for the selected instance:

[
    1489139777.721
]

5. Run the date command using the timestamp value returned at the previous step to convert it to a human readable date value: