cis-aws-storage-6-4

name	cis-aws-storage-6.4
description	Ensure configuration of replication settings
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","edr","replication","data-duplication","bandwidth","rto","rpo"]
cis_id	6.4
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-6.1","cis-aws-storage-6.2","cis-aws-storage-6.3","cis-aws-storage-6.6"]
prerequisites	[]
severity_boost	{}

CIS 6.4: Ensure configuration of replication settings (Manual)

Profile Applicability

• Level: 2

Description

Set up and maintain the replication settings to ensure accurate and efficient data duplication across systems. Proper configuration includes specifying source and target locations, defining replication schedules, and setting bandwidth limits to optimize performance. Regularly review and update these settings to accommodate changes in data volume and network conditions, ensuring data integrity and availability during replication processes.

Rationale

Proper configuration of replication settings is essential to ensure data consistency and availability across systems. Accurate replication schedules and bandwidth management optimize performance and prevent network congestion. Regular reviews and updates of these settings help adapt to changes in data volume and network conditions, maintaining efficient and reliable data replication processes.

Impact

Replication configuration affects:

• Data consistency across regions
• Network bandwidth utilization
• Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
• Operational costs
• System performance

Audit Procedure

Via AWS Console

1. Access Replication Settings:

   • Select "Configure and Initialize" in the AWS Elastic Disaster Recovery screen.
   • You will be navigated to setup your replication settings template.
   • This will create a staging area in a subnet of your choice and a replication server instance types.
   • The default replication server instance type will be a t3 micro EC2 instance. This is good for normal workloads with small I/O operations.

2. Review EBS Configuration:

   • Configure EBS encryption and volume types. This will depend on your workload requirements.
   • To encrypt EBS volumes, leave the setting as "default." If you wish to make a custom encryption setting, you will need to create an AWS KMS key.

3. Review Security Group Configuration:

   • Configure the security group to your specific needs.
   • Remember what ports need to be opened on inbound / outbound traffic that was specified in previous steps.
   • You can choose how you want your data routed and if you want to throttle network traffic to reserve bandwidth.
   • To keep your data as secure as possible, it's recommended to get set up with a VPN or AWS direct connect, so your backups are not traveling over the public internet.