Elastic Compute Cloud Should Have Recovery Point

Using Console

To remediate the misconfiguration of AWS Elastic Compute Cloud (EC2) instances not having a recovery point, you can set up automated backups using Amazon EC2’s built-in feature called Amazon EC2 Instance Recovery. Here’s a step-by-step guide on how to remediate this issue using the AWS Management Console:

Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your AWS account.
Navigate to EC2 Dashboard: From the AWS Management Console, navigate to the EC2 Dashboard by clicking on “Services” at the top of the page and selecting “EC2” under the Compute section.
Select EC2 Instances: In the EC2 Dashboard, select the EC2 instance for which you want to enable recovery points by clicking on the checkbox next to the instance ID.
Enable Instance Recovery: With the instance selected, click on the “Actions” dropdown menu at the top of the page, navigate to the “Instance Settings” option, and then select “Enable Instance Recovery” from the submenu.
Configure Recovery Settings: In the Enable Instance Recovery dialog box, you can configure the recovery settings such as the “Recovery Time Objective (RTO)” which specifies the maximum time in minutes that the instance can be unavailable during recovery. Set the RTO value based on your recovery point objective.
Enable Recovery: After configuring the recovery settings, click on the “Enable Instance Recovery” button to enable automated recovery points for the selected EC2 instance.
Verify Recovery Point: To verify that the recovery point feature is enabled for the EC2 instance, you can check the instance details and look for the “Instance Recovery” status under the “Description” tab.

By following these steps, you have successfully remediated the misconfiguration of not having a recovery point for the AWS EC2 instance by enabling the Amazon EC2 Instance Recovery feature through the AWS Management Console.

Using CLI

To remediate the misconfiguration of not having a recovery point for an AWS EC2 instance using AWS CLI, follow these steps:

Create an Amazon EBS Snapshot:
- Run the following AWS CLI command to create a snapshot of the EBS volume attached to your EC2 instance:
  aws ec2 create-snapshot --volume-id <VOLUME_ID> --description "Snapshot for recovery point"
  Replace <VOLUME_ID> with the ID of the EBS volume attached to your EC2 instance.
Tag the Snapshot (Optional but recommended):
- It is a best practice to tag your snapshots for better organization and management. You can add tags to the snapshot using the following command:
  aws ec2 create-tags --resources <SNAPSHOT_ID> --tags Key=Name,Value=<SNAPSHOT_NAME>
  Replace <SNAPSHOT_ID> with the ID of the snapshot created in the previous step and <SNAPSHOT_NAME> with a descriptive name for the snapshot.
Verify the Snapshot:
- You can verify that the snapshot has been created successfully by running the following command:
  aws ec2 describe-snapshots --snapshot-ids <SNAPSHOT_ID>
  Replace <SNAPSHOT_ID> with the ID of the snapshot created in step 1.
Automate Snapshot Creation (Optional):
- To ensure regular snapshots are created for your EC2 instances, you can set up automated snapshot creation using AWS Lambda functions or AWS Backup.

By following these steps, you have successfully remediated the misconfiguration by creating a recovery point for your AWS EC2 instance using AWS CLI.

Using Python

To remediate the misconfiguration of AWS EC2 instances not having a recovery point, you can create a backup or snapshot of the EC2 instance using Python and AWS Boto3 library. Here are the steps to remediate this issue:

Install the Boto3 library:

pip install boto3

Create a Python script to take a snapshot of the EC2 instance. Here is an example script:

import boto3

# Initialize the EC2 client
ec2 = boto3.client('ec2')

# Get the instance ID of the EC2 instance for which you want to create a snapshot
instance_id = 'YOUR_INSTANCE_ID'

# Create a snapshot of the EC2 instance
response = ec2.create_snapshot(
    Description='Snapshot for recovery point',
    VolumeId='YOUR_VOLUME_ID'
)

print(response)

Replace 'YOUR_INSTANCE_ID' and 'YOUR_VOLUME_ID' with the actual instance ID and volume ID of the EC2 instance for which you want to create a recovery point.
Run the Python script to create a snapshot of the EC2 instance. This snapshot can be used as a recovery point in case of any issues with the EC2 instance.

By following these steps, you can remediate the misconfiguration of AWS EC2 instances not having a recovery point by creating a snapshot of the instance using Python and Boto3.

Using Terraform

Terraform cannot start an on‑demand AWS Backup job (the start-backup-job operation is not exposed as a Terraform resource or argument), so you cannot create the one‑time recovery point required by this finding via Terraform alone.Use the provided CLI (or Console) once to create the initial recovery point:

aws backup start-backup-job \
  --backup-vault-name YOUR_BACKUP_VAULT_NAME \
  --resource-arn arn:aws:ec2:REGION:ACCOUNT_ID:instance/EC2_INSTANCE_ID \
  --iam-role-arn YOUR_BACKUP_SERVICE_ROLE_ARN \
  --region REGION

Then, in Terraform, configure continuous protection so the finding does not recur (this does not retroactively create the first recovery point):

resource "aws_backup_vault" "this" {
  name = "YOUR_BACKUP_VAULT_NAME"
}

resource "aws_iam_role" "backup_service_role" {
  name               = "AWSBackupDefaultServiceRole"
  assume_role_policy = data.aws_iam_policy_document.backup_assume_role.json
}

data "aws_iam_policy_document" "backup_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }
  }
}

resource "aws_iam_role_policy_attachment" "backup_service_role_policy" {
  role       = aws_iam_role.backup_service_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
}

resource "aws_backup_plan" "ec2_plan" {
  name = "EC2_BACKUP_PLAN"

  rule {
    rule_name         = "daily-ec2-backups"
    target_vault_name = aws_backup_vault.this.name
    schedule          = "cron(0 5 * * ? *)" # adjust schedule as needed

    lifecycle {
      delete_after = 30
    }
  }
}

resource "aws_backup_selection" "ec2_selection" {
  name         = "EC2_INSTANCE_SELECTION"
  iam_role_arn = aws_iam_role.backup_service_role.arn
  plan_id      = aws_backup_plan.ec2_plan.id

  resources = [
    "arn:aws:ec2:REGION:ACCOUNT_ID:instance/EC2_INSTANCE_ID",
  ]
}

No resources above force replacement of existing EC2 instances; they create/attach backup configuration only.For verification, terraform plan should show creation of aws_backup_vault, aws_iam_role (and attachment), aws_backup_plan, and aws_backup_selection, with no changes to the aws_instance itself.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Elastic Compute Cloud Should Have Recovery Point

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: