Cis AWS Storage 6.7

CIS 6.7: Ensure proper configuration of the Launch Settings (Manual)

Profile Applicability

• Level: 2

Description

Set up and verify the launch settings to ensure systems and applications start correctly and securely. This includes defining startup parameters, specifying required resources, and configuring security settings to prevent unauthorized changes. Regularly review and update these settings to align with best practices and organizational requirements, ensuring optimal performance and security at launch.

Rationale

Proper configuration of launch settings is crucial for ensuring that systems and applications start securely and perform optimally. Defining startup parameters and resource requirements prevents potential issues and enhances efficiency. Regular reviews and updates of these settings help maintain alignment with best practices and evolving organizational needs, thereby strengthening security and operational reliability from the moment of launch.

Impact

Launch settings configuration affects:

• System startup behavior
• Resource allocation
• Security posture at launch
• Recovery instance performance
• Operational reliability

Note: The settings can be changed after instances have been launched, but a new instance must be launched for new launch settings to take effect.

Audit Procedure

Via AWS Console

1. Select Launch Settings:

   • Select launch settings on the source server page

2. Configure Launch Settings:

   • On the launch settings page, next to general launch, select "edit"

3. Configure EC2 Launch Template:

   • Enable auto assign public IP and change the instance type to a t2.medium

4. Set Version to Default:

   • Set version to default in the console

5. Set Default Version:

   • Set the default version that was just created to default version

6. Return to Dashboard:

   • Return to the dashboard and confirm your configurations are correct.

Expected Result

• Launch settings accessible from source server page
• General launch settings configured
• EC2 launch template configured with:
  • Auto-assign public IP enabled
  • Instance type set to t2.medium (or appropriate size)
• Default version set in console
• New version created and set as default
• Configurations verified and confirmed correct
• Settings documented

Remediation

Via AWS Console

1. Access Launch Settings:

   • Navigate to source server page
   • Select launch settings

2. Edit General Launch:

   • Click "edit" next to general launch

3. Configure EC2 Template:

   • Enable auto assign public IP
   • Change instance type to t2.medium (or appropriate size for workload)

4. Set Version:

   • Set version to default in the console
   • Confirm the default version setting

5. Verify Configuration:

   • Return to the dashboard
   • Confirm all configurations are correct
   • Document the settings

6. Note:

   • Remember that a new instance must be launched for new launch settings to take effect
   • Plan instance launches accordingly

Default Value

By default, launch settings are not configured. Organizations must manually configure startup parameters, resource allocations, and security settings.

References

• AWS Elastic Disaster Recovery Launch Settings
• AWS EC2 Launch Templates

CIS Controls

Profile

• Level 2