cis-aws-storage-2-4

name	cis-aws-storage-2.4
description	Ensure the creation of a new volume
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","ebs","encryption","kms","data-protection","delete-on-termination"]
cis_id	2.4
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	["CWE-311","CWE-404"]
chains_with	["cis-aws-storage-2.3","cis-aws-storage-2.5"]
prerequisites	["cis-aws-storage-2.1"]
severity_boost	{}

CIS Control 2.4: Ensure the creation of a new volume (Manual)

Profile Applicability

• Level 2

Description

Leave the root volume unchanged and create a new volume. To ensure the security of the instance and prevent data loss, select "no" under the "delete on termination" option and encrypt your volume using AWS KMS. A default key is available for encrypting the volume.

Rationale

By leaving the root volume unchanged and creating a new volume, you separate critical data from the operating system. Selecting "no" for the "delete on termination" option ensures that data on the new volume is not automatically deleted when the instance is terminated, protecting against accidental data loss. Encrypting the volume using AWS KMS adds an additional layer of security, safeguarding the data against unauthorized access. The use of a default key for encryption simplifies the process while maintaining strong security measures.

Impact

Not following these steps can lead to data loss, security risks, operational disruptions, and prolonged recovery times. Setting "delete on termination" to "no" prevents data deletion upon instance termination, while encrypting the volume with AWS KMS protects against unauthorized access. Storing critical data separately from the root volume ensures operational continuity and easier recovery.

Audit Procedure

Via AWS Management Console

To audit this configuration in AWS, follow these steps:

1. Access the AWS Management Console

   • Log in to your AWS account and navigate to the AWS Management Console

2. Review EBS Volumes

   • Go to the EC2 Dashboard and select "Volumes" under the "Elastic Block Store" section
   • Check the properties of each volume to ensure that the root volume is unchanged and new volumes are created as needed

3. Check "Delete on Termination" Setting

   • In the "Volumes" section, select each volume and click on the "Actions" button
   • Select "Modify Volume" and ensure that "Delete on Termination" is set to "no" for the critical volumes

4. Verify Encryption

   • In the "Volumes" section, check the "Encrypted" column to confirm that the volumes are encrypted
   • For detailed information, select a volume and view its details to ensure it is encrypted using AWS KMS

5. Review IAM Policies

   • Navigate to the IAM Dashboard and review the policies attached to users, groups, and roles to ensure they have appropriate permissions to create, modify, and encrypt EBS volumes