Cis AWS Storage 6.5

CIS 6.5: Ensure proper IAM configuration for AWS Elastic Disaster Recovery (Manual)

Profile Applicability

• Level: 2

Description

Set up and maintain Identity and Access Management (IAM) roles and policies specifically for AWS Elastic Disaster Recovery. This includes defining least-privilege access for users and services, creating roles for automated processes, and enforcing multi-factor authentication (MFA) for added security. Regularly review and update IAM policies to adapt to changes in the organization and to maintain compliance with security best practices, ensuring that only authorized personnel and services can access and manage disaster recovery resources.

Rationale

Proper IAM configuration for AWS Elastic Disaster Recovery ensures that only authorized users and services have access to critical recovery functions, reducing the risk of unauthorized access and potential security breaches. Implementing least-privilege access and MFA enhances security by limiting permissions and adding an extra layer of authentication. Regular reviews and updates of IAM policies help maintain security compliance and adapt to organizational changes, ensuring continuous protection of disaster recovery resources.

Impact

Implementing proper IAM configuration requires:

• Creation and maintenance of specialized IAM roles
• Policy development for least-privilege access
• MFA enforcement for human users
• Regular policy reviews and updates
• Audit trail monitoring

Audit Procedure

Via AWS Console

To create DRS Agent User:

1. Navigate to the AWS IAM Console: https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/home

2. Create new user:

   • This user will be able to access the Elastic disaster recovery agent installation resource.
   • Name the user "DSRuser"

3. Allow Programmatic access:

   • This allows the user to access resources programmatically with a secure key rather than having to enter a password.

4. Elect "attach policies directly" and search for "AWSElasticDisasterRecoveryAgentInstallationPolicy"

5. Create user.

To create Failback Agent User:

Follow the steps above with these two modifications:

1. Name the user "FailbackAgentuser"
2. Apply the "AWSElasticDisasterRecoveryFailbackInstallationPolicy"

Expected Result

• DRS Agent User created with name "DSRuser"
• Programmatic access enabled for DSRuser
• AWSElasticDisasterRecoveryAgentInstallationPolicy attached to DSRuser
• Failback Agent User created with name "FailbackAgentuser"
• Programmatic access enabled for FailbackAgentuser
• AWSElasticDisasterRecoveryFailbackInstallationPolicy attached to FailbackAgentuser
• No additional unnecessary permissions granted
• MFA enabled for human users with EDR access
• IAM policies follow least-privilege principle
• Regular policy review schedule established

Remediation

Via AWS Console

1. Create DRS Agent User:

   • Navigate to AWS IAM Console
   • Create new user named "DSRuser"
   • Enable programmatic access
   • Attach "AWSElasticDisasterRecoveryAgentInstallationPolicy"
   • Create user

2. Create Failback Agent User:

   • Navigate to AWS IAM Console
   • Create new user named "FailbackAgentuser"
   • Enable programmatic access
   • Attach "AWSElasticDisasterRecoveryFailbackInstallationPolicy"
   • Create user

3. Enforce MFA:

   • For all human users with EDR access
   • Configure MFA requirements in IAM policies

4. Review Permissions:

   • Audit all EDR-related IAM policies
   • Remove unnecessary permissions
   • Implement least-privilege access

5. Establish Review Schedule:

   • Set up regular IAM policy reviews
   • Document review process
   • Update policies as needed

Default Value

Configure IAM Credentials for AWS Elastic Disaster Recovery.

By default, no specialized IAM users or policies for EDR exist. Organizations must manually create and configure IAM resources.

References

• AWS IAM Console
• AWS Elastic Disaster Recovery IAM Policies

CIS Controls

Profile

• Level 2