3.3 Ensure EFS and VPC Integration (Manual)
Profile Applicability
Description
You can use EFS as a network file system across availability zones on a virtual private cloud. This capability allows the organization to create a highly available file sharing solution. Leveraging AWS VPC and EC2 in tandem with AWS EFS makes for a highly available and scalable cloud file storage solution.
Rationale
Redundancy and scalability are crucial for maintaining uninterrupted services. By integrating these AWS services, users can harness the full power of AWS, ensuring a resilient and scalable infrastructure.
Impact
Not integrating AWS services for redundancy and scalability can lead to service disruptions and increased downtime. This approach also limits your ability to efficiently handle growing workloads, negatively impacting performance and user experience.
Audit Procedure
Audit Procedures for AWS Redundancy and Scalability
Create Mount Targets in Each Availability Zone: Ensure EFS is attached in each availability zone by creating mount targets in each subnet. Although multiple subnets can exist per availability zone, verify that EFS is configured to work with one subnet per zone to maintain redundancy.
Monitor EFS with CloudWatch: Use AWS CloudWatch to automatically monitor your EFS service. Check that alarms are configured and logs and events are tracked effectively, providing real-time insights into the performance and health of your file systems.
Expected Result
- Mount targets should exist in each availability zone
- EFS should be configured for high availability across multiple subnets
- CloudWatch monitoring should be enabled with appropriate alarms configured
Remediation
Console
Create an EC2 instance in each availability zone within your VPC.
Default Value
By default, AWS does not automatically create mount targets in all availability zones. Users must explicitly configure EFS mount targets for each desired availability zone to ensure redundancy.
References
- https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html#how-it-works-conceptual
CIS Controls
| Controls Version |
Control |
IG 1 |
IG 2 |
IG 3 |
| v8 |
3.11 Encrypt Sensitive Data at RestEncrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data. |
|
● |
● |
| v8 |
16.7 Use Standard Hardening Configuration Templates for Application InfrastructureUse standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening. |
|
● |
● |
| v7 |
13.4 Only Allow Access to Authorized Cloud Storage or Email ProvidersOnly allow access to authorized cloud storage or email providers. |
|
● |
● |
| v7 |
14.6 Protect Information through Access Control ListsProtect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. |
● |
● |
● |
Profile
Level 2
1---2name: cis-aws-storage-3-33description: Ensure EFS and VPC Integration for redundancy and scalability4---56# 3.3 Ensure EFS and VPC Integration (Manual)78## Profile Applicability910- Level 21112## Description1314You can use EFS as a network file system across availability zones on a virtual private cloud. This capability allows the organization to create a highly available file sharing solution. Leveraging AWS VPC and EC2 in tandem with AWS EFS makes for a highly available and scalable cloud file storage solution.1516## Rationale1718Redundancy and scalability are crucial for maintaining uninterrupted services. By integrating these AWS services, users can harness the full power of AWS, ensuring a resilient and scalable infrastructure.1920## Impact2122Not integrating AWS services for redundancy and scalability can lead to service disruptions and increased downtime. This approach also limits your ability to efficiently handle growing workloads, negatively impacting performance and user experience.2324## Audit Procedure2526### Audit Procedures for AWS Redundancy and Scalability27281. **Create Mount Targets in Each Availability Zone**: Ensure EFS is attached in each availability zone by creating mount targets in each subnet. Although multiple subnets can exist per availability zone, verify that EFS is configured to work with one subnet per zone to maintain redundancy.29302. **Monitor EFS with CloudWatch**: Use AWS CloudWatch to automatically monitor your EFS service. Check that alarms are configured and logs and events are tracked effectively, providing real-time insights into the performance and health of your file systems.3132## Expected Result3334- Mount targets should exist in each availability zone35- EFS should be configured for high availability across multiple subnets36- CloudWatch monitoring should be enabled with appropriate alarms configured3738## Remediation3940### Console4142Create an EC2 instance in each availability zone within your VPC.4344## Default Value4546By default, AWS does not automatically create mount targets in all availability zones. Users must explicitly configure EFS mount targets for each desired availability zone to ensure redundancy.4748## References49501. https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html#how-it-works-conceptual5152## CIS Controls5354| Controls Version | Control | IG 1 | IG 2 | IG 3 |55| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---- | ---- | ---- |56| v8 | 3.11 Encrypt Sensitive Data at Rest<br/>Encrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data. | | ● | ● |57| v8 | 16.7 Use Standard Hardening Configuration Templates for Application Infrastructure<br/>Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening. | | ● | ● |58| v7 | 13.4 Only Allow Access to Authorized Cloud Storage or Email Providers<br/>Only allow access to authorized cloud storage or email providers. | | ● | ● |59| v7 | 14.6 Protect Information through Access Control Lists<br/>Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. | ● | ● | ● |6061## Profile6263Level 2
cyberstrikeus