cis-aws-storage-6-5

name	cis-aws-storage-6.5
description	Ensure proper IAM configuration for AWS Elastic Disaster Recovery
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","edr","iam","access-control","mfa","least-privilege","authentication"]
cis_id	6.5
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-6.1","cis-aws-storage-6.6"]
prerequisites	[]
severity_boost	{}

CIS 6.5: Ensure proper IAM configuration for AWS Elastic Disaster Recovery (Manual)

Profile Applicability

• Level: 2

Description

Set up and maintain Identity and Access Management (IAM) roles and policies specifically for AWS Elastic Disaster Recovery. This includes defining least-privilege access for users and services, creating roles for automated processes, and enforcing multi-factor authentication (MFA) for added security. Regularly review and update IAM policies to adapt to changes in the organization and to maintain compliance with security best practices, ensuring that only authorized personnel and services can access and manage disaster recovery resources.

Rationale

Proper IAM configuration for AWS Elastic Disaster Recovery ensures that only authorized users and services have access to critical recovery functions, reducing the risk of unauthorized access and potential security breaches. Implementing least-privilege access and MFA enhances security by limiting permissions and adding an extra layer of authentication. Regular reviews and updates of IAM policies help maintain security compliance and adapt to organizational changes, ensuring continuous protection of disaster recovery resources.

Impact

Implementing proper IAM configuration requires:

• Creation and maintenance of specialized IAM roles
• Policy development for least-privilege access
• MFA enforcement for human users
• Regular policy reviews and updates
• Audit trail monitoring

Audit Procedure

Via AWS Console

To create DRS Agent User:

1. Navigate to the AWS IAM Console: https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/home

2. Create new user:

   • This user will be able to access the Elastic disaster recovery agent installation resource.
   • Name the user "DSRuser"

3. Allow Programmatic access:

   • This allows the user to access resources programmatically with a secure key rather than having to enter a password.

4. Elect "attach policies directly" and search for "AWSElasticDisasterRecoveryAgentInstallationPolicy"

5. Create user.

To create Failback Agent User:

Follow the steps above with these two modifications:

1. Name the user "FailbackAgentuser"
2. Apply the "AWSElasticDisasterRecoveryFailbackInstallationPolicy"