> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Elastic Compute Cloud Should Have Recovery Point ### More Info: This rule checks if a recovery point was created for Amazon Elastic Compute Cloud (Amazon EC2) instances. The rule is NON\_COMPLIANT if the Amazon EC2 instance does not have a corresponding recovery point created . ### Risk Level High ### Address Configuration ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of AWS Elastic Compute Cloud (EC2) instances not having a recovery point, you can set up automated backups using Amazon EC2's built-in feature called Amazon EC2 Instance Recovery. Here's a step-by-step guide on how to remediate this issue using the AWS Management Console: 1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)) and log in to your AWS account. 2. **Navigate to EC2 Dashboard**: From the AWS Management Console, navigate to the EC2 Dashboard by clicking on "Services" at the top of the page and selecting "EC2" under the Compute section. 3. **Select EC2 Instances**: In the EC2 Dashboard, select the EC2 instance for which you want to enable recovery points by clicking on the checkbox next to the instance ID. 4. **Enable Instance Recovery**: With the instance selected, click on the "Actions" dropdown menu at the top of the page, navigate to the "Instance Settings" option, and then select "Enable Instance Recovery" from the submenu. 5. **Configure Recovery Settings**: In the Enable Instance Recovery dialog box, you can configure the recovery settings such as the "Recovery Time Objective (RTO)" which specifies the maximum time in minutes that the instance can be unavailable during recovery. Set the RTO value based on your recovery point objective. 6. **Enable Recovery**: After configuring the recovery settings, click on the "Enable Instance Recovery" button to enable automated recovery points for the selected EC2 instance. 7. **Verify Recovery Point**: To verify that the recovery point feature is enabled for the EC2 instance, you can check the instance details and look for the "Instance Recovery" status under the "Description" tab. By following these steps, you have successfully remediated the misconfiguration of not having a recovery point for the AWS EC2 instance by enabling the Amazon EC2 Instance Recovery feature through the AWS Management Console. # To remediate the misconfiguration of not having a recovery point for an AWS EC2 instance using AWS CLI, follow these steps: 1. **Create an Amazon EBS Snapshot**: * Run the following AWS CLI command to create a snapshot of the EBS volume attached to your EC2 instance: ``` aws ec2 create-snapshot --volume-id --description "Snapshot for recovery point" ``` Replace `` with the ID of the EBS volume attached to your EC2 instance. 2. **Tag the Snapshot** (Optional but recommended): * It is a best practice to tag your snapshots for better organization and management. You can add tags to the snapshot using the following command: ``` aws ec2 create-tags --resources --tags Key=Name,Value= ``` Replace `` with the ID of the snapshot created in the previous step and `` with a descriptive name for the snapshot. 3. **Verify the Snapshot**: * You can verify that the snapshot has been created successfully by running the following command: ``` aws ec2 describe-snapshots --snapshot-ids ``` Replace `` with the ID of the snapshot created in step 1. 4. **Automate Snapshot Creation** (Optional): * To ensure regular snapshots are created for your EC2 instances, you can set up automated snapshot creation using AWS Lambda functions or AWS Backup. By following these steps, you have successfully remediated the misconfiguration by creating a recovery point for your AWS EC2 instance using AWS CLI. To remediate the misconfiguration of AWS EC2 instances not having a recovery point, you can create a backup or snapshot of the EC2 instance using Python and AWS Boto3 library. Here are the steps to remediate this issue: 1. Install the Boto3 library: ```bash theme={null} pip install boto3 ``` 2. Create a Python script to take a snapshot of the EC2 instance. Here is an example script: ```python theme={null} import boto3 # Initialize the EC2 client ec2 = boto3.client('ec2') # Get the instance ID of the EC2 instance for which you want to create a snapshot instance_id = 'YOUR_INSTANCE_ID' # Create a snapshot of the EC2 instance response = ec2.create_snapshot( Description='Snapshot for recovery point', VolumeId='YOUR_VOLUME_ID' ) print(response) ``` 3. Replace `'YOUR_INSTANCE_ID'` and `'YOUR_VOLUME_ID'` with the actual instance ID and volume ID of the EC2 instance for which you want to create a recovery point. 4. Run the Python script to create a snapshot of the EC2 instance. This snapshot can be used as a recovery point in case of any issues with the EC2 instance. By following these steps, you can remediate the misconfiguration of AWS EC2 instances not having a recovery point by creating a snapshot of the instance using Python and Boto3. Terraform cannot start an on‑demand AWS Backup job (the `start-backup-job` operation is not exposed as a Terraform resource or argument), so you cannot create the one‑time recovery point required by this finding via Terraform alone. Use the provided CLI (or Console) once to create the initial recovery point: ```bash theme={null} aws backup start-backup-job \ --backup-vault-name YOUR_BACKUP_VAULT_NAME \ --resource-arn arn:aws:ec2:REGION:ACCOUNT_ID:instance/EC2_INSTANCE_ID \ --iam-role-arn YOUR_BACKUP_SERVICE_ROLE_ARN \ --region REGION ``` Then, in Terraform, configure continuous protection so the finding does not recur (this does not retroactively create the first recovery point): ```hcl theme={null} resource "aws_backup_vault" "this" { name = "YOUR_BACKUP_VAULT_NAME" } resource "aws_iam_role" "backup_service_role" { name = "AWSBackupDefaultServiceRole" assume_role_policy = data.aws_iam_policy_document.backup_assume_role.json } data "aws_iam_policy_document" "backup_assume_role" { statement { actions = ["sts:AssumeRole"] principals { type = "Service" identifiers = ["backup.amazonaws.com"] } } } resource "aws_iam_role_policy_attachment" "backup_service_role_policy" { role = aws_iam_role.backup_service_role.name policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup" } resource "aws_backup_plan" "ec2_plan" { name = "EC2_BACKUP_PLAN" rule { rule_name = "daily-ec2-backups" target_vault_name = aws_backup_vault.this.name schedule = "cron(0 5 * * ? *)" # adjust schedule as needed lifecycle { delete_after = 30 } } } resource "aws_backup_selection" "ec2_selection" { name = "EC2_INSTANCE_SELECTION" iam_role_arn = aws_iam_role.backup_service_role.arn plan_id = aws_backup_plan.ec2_plan.id resources = [ "arn:aws:ec2:REGION:ACCOUNT_ID:instance/EC2_INSTANCE_ID", ] } ``` No resources above force replacement of existing EC2 instances; they create/attach backup configuration only. For verification, `terraform plan` should show creation of `aws_backup_vault`, `aws_iam_role` (and attachment), `aws_backup_plan`, and `aws_backup_selection`, with no changes to the `aws_instance` itself. ### Additional Reading: * [https://docs.aws.amazon.com/config/latest/developerguide/ec2-last-backup-recovery-point-created.html](https://docs.aws.amazon.com/config/latest/developerguide/ec2-last-backup-recovery-point-created.html)