cyberstrikeus 3.9 Ensure using VPC endpoints - EFS (Manual)
Profile Applicability
- Level 2
Description
With AWS PrivateLink, VPC Endpoints allow services to communicate within AWS using private IP addresses within approved CIDR ranges. This communication can be achieved without the need for a VPN, ensuring secure and efficient data transfer.
Rationale
The rationale behind using AWS PrivateLink with VPC Endpoints is to enable secure and efficient communication between services within AWS. By using private IP addresses within approved CIDR ranges, it eliminates the need for a VPN, reducing complexity and potential points of failure. This approach enhances security, reduces latency, and ensures data remains within the AWS network, aligning with best practices for secure and reliable cloud architecture.
Impact
Not using AWS PrivateLink with VPC Endpoints can lead to several issues, including increased security risks and potential data exposure since services would need to communicate over the public internet or through more complex VPN setups. This can result in higher latency, reduced performance, and greater vulnerability to attacks. Additionally, managing VPN connections adds complexity and potential points of failure, compromising the overall efficiency and reliability of your network architecture.
Audit Procedure
Console
Creating a FIPS compliant interface endpoint for EFS:
- Navigate to VPC Console: https://console.aws.amazon.com/vpc/
- Select "Endpoints" on the sidebar.
- Select "Create endpoint".
- Name the endpoint.
- Copy and paste this services into the services bar:
com.amazonaws.region.elasticfilesystem-fips– replace "region: with us-east-1 or whatever region you're using. - Select your VPC.
- For subnets, select the availability zone and then select private subnet.
- Select the Security Group for the VPC endpoint.
- For policy: select "full access".
- Create a tag for future reference / granular IAM permissions.
- Create endpoint.
Expected Result
- VPC endpoint should be created for EFS service
- Endpoint should use FIPS-compliant service name
- Endpoint should be associated with appropriate VPC and subnets
- Security group should be configured for the endpoint
- Full access policy should be configured (or restricted as per requirements)
Remediation
Console
Use VPC Endpoints in tandem with AWS Private Link to secure your EFS connections.
- Navigate to VPC Console
- Create VPC endpoint for EFS
- Configure endpoint with appropriate VPC, subnets, and security groups
- Use FIPS-compliant service endpoint:
com.amazonaws.[region].elasticfilesystem-fips - Configure access policy as needed
Default Value
VPC endpoints are not created by default. Users must explicitly create and configure VPC endpoints for EFS to enable private connectivity.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 13.5 Manage Access Control for Remote AssetsManage access control for assets remotely connecting to enterprise resources. Determine amount of access to enterprise resources based on: up-to-date anti-malware software installed, configuration compliance with the enterprise's secure configuration process, and ensuring the operating system and applications are up-to-date. | ● | ● | |
| v8 | 14.5 Train Workforce Members on Causes of Unintentional Data ExposureTrain workforce members to be aware of causes for unintentional data exposure. Example topics include mis-delivery of sensitive data, losing a portable end-user device, or publishing data to unintended audiences. | ● | ● | ● |
| v7 | 9.2 Ensure Only Approved Ports, Protocols and Services Are RunningEnsure that only network ports, protocols, and services listening on a system with validated business needs, are running on each system. | ● | ● | |
| v7 | 13.1 Maintain an Inventory Sensitive InformationMaintain an inventory of all of the sensitive information stored, processed, or transmitted by the organization's technology systems, including those located onsite or at a remote service provider. | ● | ● | ● |
Profile
Level 2