Cis AWS Storage 4.8

4.8 Ensure exporting cache to S3 (Manual)

Profile Applicability

• Level 2

Description

The S3 bucket we created earlier will store the files generated at this mount point.

Rationale

The rationale behind using the S3 bucket to store files generated at the mount point is to ensure scalable, durable, and cost-effective storage for your data. By exporting files to S3, you benefit from its high availability and robust data management features, which enhances data security and accessibility. This approach also optimizes storage resource utilization and simplifies data backup and retrieval processes.

Impact

Without exporting cache data to S3, files created in the cache mount point will not be persisted to durable storage. This can result in data loss when the cache is deleted or during cache failures, as FSx File Cache is designed as a temporary high-performance layer, not long-term storage.

Audit Procedure

SSH to EC2 Instance

1. Connect to your EC2 instance:

ssh -i "{KEY.pem}" ubuntu@{your-ec2-instance}

2. Verify mount point has files:

ls -la /mnt

3. Check S3 bucket for exported data:

# Use AWS CLI to list objects in the S3 bucket
aws s3 ls s3://<bucket-name>/<prefix>/ --recursive

# Check for specific test files
aws s3 ls s3://<bucket-name>/<prefix>/efx.txt

AWS Console

1. Navigate to the Amazon S3 console
2. Select the bucket associated with your FSx cache
3. Navigate to the prefix/folder path configured in the Data Repository Association
4. Verify that files created in the cache mount point are present in S3

Expected Result

Files created in the FSx cache mount point should be automatically exported to the S3 bucket through the Data Repository Association. The S3 bucket should contain the files with proper metadata and timestamps.

Remediation

SSH to EC2 Instance

We can export the files that were created to the S3 bucket using the following steps:

1. Create a file on the FSx mount point:

sudo touch efx.txt

2. Run the command to export the file to S3:

sudo lsm_hsm_archive efx.txt

3. Verify the file was created in the mount point:

ls -la /mnt

4. Now check your S3 bucket that was created earlier:
   • The file should now appear in the S3 bucket under the configured prefix/path

AWS CLI

# Verify file creation in mount point (run on EC2 instance)
ls -la /mnt/efx.txt

# Check S3 bucket for the exported file (can run from anywhere with AWS credentials)
aws s3 ls s3://<bucket-name>/<prefix>/efx.txt

# Verify file content matches
aws s3 cp s3://<bucket-name>/<prefix>/efx.txt -

# List all files in the S3 bucket prefix
aws s3 ls s3://<bucket-name>/<prefix>/ --recursive --human-readable

Automated Export Configuration

Ensure Data Repository Association is properly configured for automatic export:

# Verify DRA configuration
aws fsx describe-data-repository-associations \
  --filters Name=file-cache-id,Values=<cache-id> \
  --query 'Associations[0].[FileCachePath,DataRepositoryPath,DataRepositorySubdirectories]'

Default Value

By default, FSx File Cache does not automatically export files to S3 without proper Data Repository Association configuration. The lsm_hsm_archive command or automatic export policies must be used to persist data to S3.

References

1. https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/backups-exporting.html

CIS Controls

This control supports data backup and recovery best practices but does not map to specific CIS Controls.

Profile

Level 2