Skip to main content

Recovery Point Retention Should Be Reviewed

More Info:​

This rule checks if a recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.

Risk Level​

Medium

Address​

Configuration

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration related to Recovery Point Retention for AWS EC2 instances using the AWS Management Console, follow these steps:

  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in with your credentials.

  2. Navigate to AWS Backup: In the AWS Management Console, search for "Backup" in the services search bar and click on "AWS Backup" to open the AWS Backup console.

  3. Review Backup Plans: In the AWS Backup console, navigate to the "Backup plans" section on the left-hand side menu.

  4. Select the Backup Plan: Identify the backup plan that is associated with the EC2 instances for which you want to review the Recovery Point Retention.

  5. Edit Backup Plan: Click on the backup plan that you want to review and adjust the Recovery Point Retention settings for. Click on the "Edit" button to modify the backup plan.

  6. Adjust Recovery Point Retention: In the backup plan settings, locate the section related to Recovery Point Retention. Here, you can set the desired retention period for the backups of your EC2 instances. Ensure that the retention period aligns with your organization's backup and recovery requirements.

  7. Save Changes: Once you have adjusted the Recovery Point Retention settings as per your requirements, click on the "Save Changes" button to apply the modifications to the backup plan.

  8. Monitor Backup Jobs: After updating the Recovery Point Retention settings, monitor the backup jobs to ensure that the backups are being created and retained according to the new configuration.

By following these steps, you can remediate the misconfiguration related to Recovery Point Retention for AWS EC2 instances using the AWS Management Console.

Using CLI

To remediate the issue of Recovery Point Retention in AWS EC2 using AWS CLI, you can follow these steps:

Step 1: List all the existing Amazon EC2 Backup plans to identify the retention settings on AWS CLI.

aws backup list-backup-plans

Step 2: Identify the Backup Plan ID that needs to be updated based on the retention settings.

aws backup describe-backup-plan --backup-plan-id <backup-plan-id>

Step 3: Update the Backup Plan with the desired Recovery Point Retention settings. For example, to set the retention to 30 days, you can use the following command:

aws backup update-backup-plan --backup-plan-id <backup-plan-id> --lifecycle DeleteAfterDays=30

Step 4: Verify the updated Backup Plan to ensure the changes have been applied successfully.

aws backup describe-backup-plan --backup-plan-id <backup-plan-id>

By following these steps, you can remediate the issue of Recovery Point Retention in AWS EC2 using AWS CLI by updating the Backup Plan with the desired retention settings.

Using Python

To remediate the misconfiguration of Recovery Point Retention in AWS EC2 using Python, you can follow these steps:

  1. Install Boto3: Boto3 is the AWS SDK for Python. You can install it using pip:

    pip install boto3

  2. Write a Python script to update the Recovery Point Retention for EC2 instances. Here is a sample script that sets the Recovery Point Retention to 30 days for all EC2 instances:

import boto3

def update_recovery_point_retention():
    # Initialize the EC2 client
    ec2_client = boto3.client('ec2')

    # Get all EC2 instances
    instances = ec2_client.describe_instances()

    # Update the Recovery Point Retention for each instance
    for reservation in instances['Reservations']:
        for instance in reservation['Instances']:
            instance_id = instance['InstanceId']
            
            # Update the Recovery Point Retention to 30 days
            response = ec2_client.modify_instance_attribute(
                InstanceId=instance_id,
                DisableApiTermination={
                    'Value': False
                }
            )

            print(f"Recovery Point Retention updated for instance {instance_id}")

if __name__ == '__main__':
    update_recovery_point_retention()
  1. Run the Python script: Save the script in a file (e.g., update_recovery_point_retention.py) and run it using the Python interpreter. Make sure you have the necessary IAM permissions to modify EC2 instances.

This script will update the Recovery Point Retention for all EC2 instances in your AWS account to 30 days. You can modify the script to set a different retention period if needed.

Remember to always test scripts in a non-production environment before applying them to production to avoid any unintended consequences.

Using Terraform
resource "aws_backup_plan" "EC2_BACKUP_PLAN" {
  name = "EC2_BACKUP_PLAN_NAME" # replace with your backup plan name

  rule {
    rule_name         = "EC2_BACKUP_RULE_NAME"   # replace with your rule name
    target_vault_name = "BACKUP_VAULT_NAME"      # replace with your vault name
    schedule          = "CRON_EXPRESSION"        # replace with your backup schedule
    # ...any other required arguments (e.g., start_window, completion_window, etc.)

    lifecycle {
      delete_after = RETENTION_DAYS              # replace with the required retention in days, e.g. 90
      # optionally set cold_storage_after if you use cold storage
      # cold_storage_after = COLD_STORAGE_AFTER_DAYS
    }
  }
}

The individual recovery point lifecycle (aws backup update-recovery-point-lifecycle) cannot be managed via Terraform; it must be run with the AWS CLI as in the verified remediation. The Terraform change above implements the second remediation by updating the backup plan’s rule lifecycle.DeleteAfterDays for all future EC2 backups.

This change updates the existing backup plan in place (no forced replacement). After editing, terraform plan should show an in-place update to aws_backup_plan.EC2_BACKUP_PLAN with the rule[0].lifecycle.delete_after value changing from its old value to RETENTION_DAYS.

Additional Reading:​