Rule: EFS file systems should be in a backup plan

EFS File System Backup Plan for FFIEC Compliance

Overview

EFS Backup Rule Details

Criteria:

2. 1.
   Regular Backups: EFS file systems must be backed up daily.
4. 2.
   Retention Policy: Backup retention should comply with the regulatory data retention requirements, typically several years.
6. 3.
   Encryption: Backups should be encrypted at rest using AWS Key Management Service (KMS).
8. 4.
   Testing: Regular testing of backup restoration is mandatory to ensure backup reliability.

Troubleshooting Steps

Verifying Backup Plan Configurations:

2. 1.
   Log in to the AWS Backup console.
4. 2.
   Navigate to 'Backup plans'.
6. 3.
   Review the backup plans to check if a plan covers all EFS file systems.
8. 4.
   Check the schedule, retention policy, and encryption settings.

Investigating Backup Failures:

2. 1.
   Navigate to 'Job console' within AWS Backup.
4. 2.
   Look for any failed backup jobs.
6. 3.
   Review job details for error messages and logs to identify the issue.

Common Problems:

Necessary Automation Code

AWS CLI Commands

Create EFS Backup Plan

aws backup create-backup-plan --backup-plan '{
  "BackupPlanName": "EFS-Backup-Plan",
  "Rules": [
    {
      "RuleName": "DailyEFSBackupRule",
      "TargetBackupVaultName": "MyBackupVault",
      "ScheduleExpression": "cron(0 0 * * ? *)",
      "StartWindowMinutes": 60,
      "CompletionWindowMinutes": 10080,
      "Lifecycle": {
        "MoveToColdStorageAfterDays": 30,
        "DeleteAfterDays": 3650
      },
      "RecoveryPointTags": {
        "CreatedBy": "AWS Backup"
      }
    }
  ]
}'

Assign Resources to the Backup Plan

aws backup create-backup-selection --backup-plan-id "<backup_plan_id>" --backup-selection '{
  "SelectionName": "EFS-Backup-Selection",
  "IamRoleArn": "arn:aws:iam::123456789012:role/service-role/AWSBackupDefaultServiceRole",
  "Resources": [
    "arn:aws:elasticfilesystem:region:account-id:file-system/fs-id"
  ]
}'

<backup_plan_id>

region

account-id

fs-id

Step by Step Guide for Remediation

2. 1.
   Navigate to the AWS Backup console.
4. 2.
   Click 'Create a backup plan' and select a template or start with an empty plan.
6. 3.
   Name your backup plan appropriately.
8. 4.
   Design the plan with daily backups, set the retention period, and choose encryption with a suitable KMS key.
10. 5.
    Assign the newly created backup plan to EFS file systems.
12. 6.
    Make sure the IAM role ‘AWSBackupDefaultServiceRole’ has the proper permissions.
14. 7.
    Monitor backups regularly and test restorations quarterly.
16. 8.
    Make adjustments to your backup plan based on testing feedback and ongoing FFIEC guidelines.