Cloud Defense Logo

Products

Solutions

Company

Book A Live Demo

Rule: EFS File Systems Should Be Protected by Backup Plan

This rule ensures that EFS file systems are backed up for data protection.

RuleEFS file systems should be protected by backup plan
FrameworkFedRAMP Moderate Revision 4
Severity
High

EFS File Systems Should be Protected by Backup Plan for FedRAMP Moderate Revision 4

Amazon Elastic File System (EFS) is a scalable file storage service for use with Amazon EC2 instances and AWS services. Under the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline, it is necessary to ensure that EFS file systems have an adequate backup plan for disaster recovery and data protection. An effective backup solution is a crucial component of compliance and data integrity.

Detailed Description of the Rule

Requirement

EFS file systems containing sensitive or mission-critical data, which fall under the purview of FedRAMP Moderate standards, must have a backup policy in place to provide data redundancy and facilitate disaster recovery. The absence of such a plan might result in non-compliance with federal regulations and could potentially lead to data loss.

Implementation

A suitable backup plan involves the regular and systematic creation of data snapshots or backups that are stored securely, are easily retrievable, and allow for quick restoration in case of data loss. AWS Backup service can be utilized to automate and manage backups consistently across the AWS services that support it, including EFS.

Steps to Ensure Compliant Backups for EFS

1. Assess EFS file systems

Before creating a backup plan, inventory your EFS file systems and classify the data they hold to determine the appropriate backup frequency and retention period.

2. Create an AWS Backup Plan

Use AWS Backup to set up a backup plan:

Step-by-Step Guide:

  • Navigate to the AWS Backup console.
  • Click on "Create backup plan" from a template or build a custom one.
  • Define the backup rules (frequency, window, lifecycle, etc.).
  • Assign resources by tags or select the EFS file systems directly.

CLI Command to Create a Backup Plan:

aws backup create-backup-plan --backup-plan '{
  "BackupPlanName": "EFSBackupPlan",
  "Rules": [
    {
      "RuleName": "DailyBackup",
      "TargetBackupVaultName": "[YourBackupVault]",
      "ScheduleExpression": "cron(0 12 * * ? *)",
      "StartWindowMinutes": 120,
      "CompletionWindowMinutes": 360,
      "Lifecycle": {
        "MoveToColdStorageAfterDays": 30,
        "DeleteAfterDays": 365
      }
    }
  ]
}'

3. Verify Backup Policy Implementation

Regularly monitor and verify that backups are being created as per the defined schedule:

Checking Backups via Console:

  • Go to the AWS Backup console.
  • Navigate to the "Protected resources" tab to see the list of backups.

Checking Backups via CLI:

aws backup list-backup-jobs --by-resource-id [YourEFSFileSystemId]

4. Test Recovery Procedures

Ensure your disaster recovery procedure is operational by periodically testing the recovery of your EFS from backups.

Recovering File System via Console:

  • Access the AWS Backup console.
  • Select the desired recovery point and follow through the recovery wizard.

Recovering File System via CLI:

aws backup start-restore-job --recovery-point-arn [YourRecoveryPointArn] --metadata '{"file-system-id": "[YourEFSFileSystemId]", "encrypted": "True", "kmsKeyId": "[YourKMSKeyID]"}'

Remediation

Manual Remediations:

  • If an EFS file system isn’t backed up, manually create a backup using the AWS Backup console or CLI.
  • Ensure that all EFS file systems have tags that match the backup plan to guarantee they are included in automated backups.

Automated Remediations:

Leverage AWS Lambda functions triggered by CloudWatch Events or AWS Config rules to automatically include EFS file systems in backup plans or to create backups when a new EFS file system is detected.

Conclusion

Adherence to this rule helps ensure compliance with FedRAMP Moderate requirements, offering reliable backup solutions for Amazon EFS file systems. Maintaining backups as part of a comprehensive disaster recovery strategy reduces risks associated with data loss and ensures business continuity. Implementing these steps will not only help maintain compliance but also contribute positively to the overall data management and security posture.

To integrate advanced SEO practices, one would need to ensure the use of relevant keywords such as "EFS backup", "AWS backup compliance", "FedRAMP Moderate data protection", etc., and provide valuable and actionable content like the detailed steps, codes and commands provided in this answer, which in turn increases the content's relevance thus improving SEO ranking.

Is your System Free of Underlying Vulnerabilities?
Find Out Now