Rule: EC2 Instances Should Be Protected by Backup Plan

EC2 Backup Compliance with NIST Cybersecurity Framework (CSF) v1

Rule / Policy Description

Troubleshooting Steps

2. 1.
   Check Backup Configurations: Verify that the backup jobs are correctly configured according to the backup policy.
4. 2.
   Review IAM Permissions: Ensure that the AWS Identity and Access Management (IAM) roles have the necessary permissions to execute backups.
6. 3.
   Monitor CloudWatch Logs: Inspect Amazon CloudWatch logs for any error messages related to backup processes.
8. 4.
   Validate Network Connectivity: Ensure the instance has network connectivity to reach backup targets.

Necessary Codes

AWS CLI Commands for DLM:

# Create a backup policy
aws dlm create-lifecycle-policy --description "DailyBackups" --state ENABLED --execution-role-arn EXECUTION_ROLE_ARN --policy-details file://policy-details.json

# Example policy-details.json
{
   "PolicyType": "EBS_SNAPSHOT_MANAGEMENT",
   "ResourceTypes": [
      "VOLUME"
   ],
   "TargetTags": [
      {
         "Key": "Backup",
         "Value": "True"
      }
   ],
   "Schedules": [
      {
         "Name": "DailyBackups",
         "TagsToAdd": [
            {
               "Key": "Backup",
               "Value": "Daily"
            }
         ],
         "CreateRule": {
            "Interval": 24,
            "IntervalUnit": "HOURS",
            "Times": ["03:00"]
         },
         "RetainRule": {
            "Count": 7
         },
         "CopyTags": false
      }
   ]
}

Step by Step Guide for Remediation

2. 1.

   Set Up AWS Backup:

   • Navigate to the AWS Backup console.
   • Create a new backup plan or select a pre-built template that complies with NIST CSF.
   • Configure backup rules (frequency, lifecycle, etc.).
   • Assign resources to the backup plan by tagging EC2 instances.
4. 2.

   Configure DLM Policies (Optional if using AWS Backup):

   • Create an IAM role for DLM with required permissions.
   • Use AWS CLI to create lifecycle policies, specifying intervals and retention rules.
6. 3.

   Regular Compliance Checks:

   • Schedule routine checks to ensure the backups meet required compliance standards.
   • Use AWS Config to set compliance rules and receive alerts.
8. 4.

   Test Recovery Procedures:

   • Perform regular test restorations to ensure the integrity and effectiveness of your backups.