3.2 Ensure Implementation of EFS (Manual)
Profile Applicability
Description
AWS EFS is a fully managed storage service that enables rapid file system deployment without the need for configuration, patching, or maintenance.
Rationale
The rationale behind using AWS EFS is to simplify and expedite the deployment of file systems, eliminating the need for manual configuration, patching, and maintenance. This allows you to focus on other critical aspects of your operations while benefiting from a reliable, scalable, and fully managed storage solution.
Impact
Not using AWS EFS can lead to increased complexity and time-consuming manual management for configuration, patching, and maintenance. This raises the risk of human error, system downtime, and data loss, while also making it more challenging to scale your file systems efficiently.
Audit Procedure
Console
- Navigate to console - https://us-east-1.console.aws.amazon.com/efs/home?region=us-east-1#/get-started
- Select "Create File System". Give the file system a name and select the default VPC. Select "Create".
- Encrypting data at rest - The EFS is encrypted automatically upon creation.
- Attach the EFS to an EC2 instance.
- Navigate to file system details - Select the radio box next to the file system that was just created and select "view details".
- Creating an NFS directory on your EC2 instance - Launch your EC2 instance. Once connected, Type following command:
sudo mkdir efs
to create a new efs directory.
- Mounting an NFS directory on your EC2 instance - Navigate to find your EC2 DNS information. Paste this command into the console after making the efs directory:
sudo mount -t nfs -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport mount-target-DNS:/ ~/efs-mount-point
NOTE: The encryption takes place as soon as you mount the directory. This encrypts the data in transit.
- Terminating the EC2 instance - The EFS file system that was just mounted doesn't persist on reboot. You can consult the AWS documentation to see how you can write a script to automatically mount the file system upon every reboot.
Expected Result
- EFS file system should be created successfully
- Encryption at rest should be enabled by default
- NFS directory should be created and mounted on EC2 instance
- Data should be encrypted in transit when mounting
Remediation
Console
To remediate the issues of manual file system management, follow these steps to create and use Amazon EFS:
Open the Amazon EFS Console: Sign in to the AWS Management Console and navigate to the Amazon EFS service.
Create a New File System: Click on "Create file system" to start the setup process.
Configure Settings: Select your desired VPC, availability zones, throughput mode, and any additional settings like lifecycle management.
Set Up Access Points: Configure access points to control permissions and simplify access management.
Review and Create: Verify your settings and click "Create" to finalize the file system setup.
Mount the File System: Use the provided mount targets and instructions to attach the file system to your EC2 instances or other resources.
Default Value
By default, AWS does not automatically create or configure EFS file systems. Users must explicitly create EFS file systems and configure encryption, which is enabled by default upon creation.
References
- https://aws.amazon.com/efs/
CIS Controls
| Controls Version |
Control |
IG 1 |
IG 2 |
IG 3 |
| v8 |
3.11 Encrypt Sensitive Data at RestEncrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data. |
|
● |
● |
| v8 |
8.3 Ensure Adequate Audit Log StorageEnsure that logging destinations maintain adequate storage to comply with the enterprise's audit log management process. |
● |
● |
● |
| v7 |
5.2 Maintain Secure ImagesMaintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates. |
|
● |
● |
| v7 |
13.4 Only Allow Access to Authorized Cloud Storage or Email ProvidersOnly allow access to authorized cloud storage or email providers. |
|
● |
● |
Profile
Level 2
1---2name: cis-aws-storage-3-23description: Ensure Implementation of EFS for managed file system deployment4---56# 3.2 Ensure Implementation of EFS (Manual)78## Profile Applicability910- Level 21112## Description1314AWS EFS is a fully managed storage service that enables rapid file system deployment without the need for configuration, patching, or maintenance.1516## Rationale1718The rationale behind using AWS EFS is to simplify and expedite the deployment of file systems, eliminating the need for manual configuration, patching, and maintenance. This allows you to focus on other critical aspects of your operations while benefiting from a reliable, scalable, and fully managed storage solution.1920## Impact2122Not using AWS EFS can lead to increased complexity and time-consuming manual management for configuration, patching, and maintenance. This raises the risk of human error, system downtime, and data loss, while also making it more challenging to scale your file systems efficiently.2324## Audit Procedure2526### Console27281. Navigate to console - https://us-east-1.console.aws.amazon.com/efs/home?region=us-east-1#/get-started292. Select "Create File System". Give the file system a name and select the default VPC. Select "Create".303. Encrypting data at rest - The EFS is encrypted automatically upon creation.314. Attach the EFS to an EC2 instance.325. Navigate to file system details - Select the radio box next to the file system that was just created and select "view details".336. Creating an NFS directory on your EC2 instance - Launch your EC2 instance. Once connected, Type following command:34 ```35 sudo mkdir efs36 ```37 to create a new efs directory.387. Mounting an NFS directory on your EC2 instance - Navigate to find your EC2 DNS information. Paste this command into the console after making the efs directory:39 ```40 sudo mount -t nfs -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport mount-target-DNS:/ ~/efs-mount-point41 ```42 NOTE: The encryption takes place as soon as you mount the directory. This encrypts the data in transit.438. Terminating the EC2 instance - The EFS file system that was just mounted doesn't persist on reboot. You can consult the AWS documentation to see how you can write a script to automatically mount the file system upon every reboot.4445## Expected Result4647- EFS file system should be created successfully48- Encryption at rest should be enabled by default49- NFS directory should be created and mounted on EC2 instance50- Data should be encrypted in transit when mounting5152## Remediation5354### Console5556To remediate the issues of manual file system management, follow these steps to create and use Amazon EFS:57581. **Open the Amazon EFS Console**: Sign in to the AWS Management Console and navigate to the Amazon EFS service.59602. **Create a New File System**: Click on "Create file system" to start the setup process.61623. **Configure Settings**: Select your desired VPC, availability zones, throughput mode, and any additional settings like lifecycle management.63644. **Set Up Access Points**: Configure access points to control permissions and simplify access management.65665. **Review and Create**: Verify your settings and click "Create" to finalize the file system setup.67686. **Mount the File System**: Use the provided mount targets and instructions to attach the file system to your EC2 instances or other resources.6970## Default Value7172By default, AWS does not automatically create or configure EFS file systems. Users must explicitly create EFS file systems and configure encryption, which is enabled by default upon creation.7374## References75761. https://aws.amazon.com/efs/7778## CIS Controls7980| Controls Version | Control | IG 1 | IG 2 | IG 3 |81| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---- | ---- | ---- |82| v8 | 3.11 Encrypt Sensitive Data at Rest<br/>Encrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data. | | ● | ● |83| v8 | 8.3 Ensure Adequate Audit Log Storage<br/>Ensure that logging destinations maintain adequate storage to comply with the enterprise's audit log management process. | ● | ● | ● |84| v7 | 5.2 Maintain Secure Images<br/>Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates. | | ● | ● |85| v7 | 13.4 Only Allow Access to Authorized Cloud Storage or Email Providers<br/>Only allow access to authorized cloud storage or email providers. | | ● | ● |8687## Profile8889Level 2
cyberstrikeus