Skip to main content

FSx Should Have Recovery Point

More Info:​

This rule checks if a recovery point was created for Amazon FSx File Systems. The rule is NON_COMPLIANT if the Amazon FSx File System does not have a corresponding recovery point .

Risk Level​

High

Address​

Configuration

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of not having a recovery point for FSx in AWS EC2, follow these steps using the AWS Management Console:

  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your AWS account.

  2. Navigate to Amazon FSx: In the AWS Management Console, search for "FSx" in the search bar at the top and click on "Amazon FSx" under the services section.

  3. Select the FSx File System: Select the FSx file system for which you want to enable recovery points by clicking on its name.

  4. Create a Recovery Point: In the FSx file system details page, navigate to the "Actions" dropdown menu and select "Take recovery points".

  5. Configure Recovery Point: In the "Create recovery point" window, you can configure the settings for the recovery point such as the name, description, and retention period. Click on the "Create recovery point" button to create the recovery point.

  6. Verify Recovery Point Creation: Once the recovery point is created, you can verify it by going to the "Recovery points" tab in the FSx file system details page.

  7. Set up Automated Backups (Optional): To ensure continuous protection of your FSx file system, you can set up automated backups by enabling the "Automatic backups" feature in the FSx file system settings.

By following these steps, you have successfully remediated the misconfiguration of not having a recovery point for FSx in your AWS EC2 environment.

Using CLI

To remediate the misconfiguration of FSx not having a recovery point for an AWS EC2 instance using AWS CLI, you can follow these steps:

  1. Create a Backup for FSx File System:

    • Use the following AWS CLI command to create a backup for the FSx file system: 
      aws fsx create-backup --file-system-id fs-1234567890abcdef0 --tags Key=Name,Value=MyBackup
    • Replace fs-1234567890abcdef0 with the actual ID of your FSx file system.
    • You can also add additional tags as needed.

  2. Verify Backup Creation:

    • Use the following AWS CLI command to describe the backup and verify that it has been created successfully: 
      aws fsx describe-backups --backup-ids backup-0abcdef1234567890
    • Replace backup-0abcdef1234567890 with the actual ID of the backup created in the previous step.

  3. Set up Backup Policy:

    • Use the following AWS CLI command to set up a backup policy for the FSx file system: 
      aws fsx update-file-system --file-system-id fs-1234567890abcdef0 --backup-policy '{"WeeklyMaintenanceStartTime": "3:00:00"}'
    • Replace fs-1234567890abcdef0 with the actual ID of your FSx file system.
    • You can customize the backup policy according to your requirements.

  4. Verify Backup Policy:

    • Use the following AWS CLI command to describe the file system and verify that the backup policy has been set up successfully: 
      aws fsx describe-file-systems --file-system-ids fs-1234567890abcdef0
    • Replace fs-1234567890abcdef0 with the actual ID of your FSx file system.

By following these steps and using the AWS CLI commands provided, you can remediate the misconfiguration of FSx not having a recovery point for an AWS EC2 instance.

Using Python

To remediate the misconfiguration of FSx not having a recovery point for an AWS EC2 instance using Python, you can use the AWS SDK for Python (Boto3) to create a backup for the FSx file system. Here are the step-by-step instructions to remediate this issue:

  1. Install Boto3: Ensure that you have the Boto3 library installed. You can install it using pip:
pip install boto3
  1. Create a Backup for FSx File System: Use the following Python script to create a backup for the FSx file system associated with your EC2 instance:
import boto3

# Initialize the FSx and EC2 clients
fsx_client = boto3.client('fsx', region_name='your_region')
ec2_client = boto3.client('ec2', region_name='your_region')

# Get the FSx file system ID associated with the EC2 instance
response = ec2_client.describe_instances(InstanceIds=['your_instance_id'])
fsx_file_system_id = response['Reservations'][0]['Instances'][0]['BlockDeviceMappings'][0]['Ebs']['VolumeId']

# Create a backup for the FSx file system
response = fsx_client.create_backup(FileSystemId=fsx_file_system_id, BackupType='USER_INITIATED', ClientRequestToken='your_unique_token')
backup_id = response['Backup']['BackupId']

print(f"Backup created successfully with Backup ID: {backup_id}")
  1. Replace the placeholders:
  • Replace 'your_region' with the AWS region where your EC2 instance and FSx file system are located.
  • Replace 'your_instance_id' with the ID of your EC2 instance.
  • Replace 'your_unique_token' with a unique client request token to identify the backup request.
  1. Run the Python script: Save the Python script to a file (e.g., create_fsx_backup.py) and run it using the Python interpreter:
python create_fsx_backup.py

After running the script, a backup will be created for the FSx file system associated with your EC2 instance. This will remediate the misconfiguration of FSx not having a recovery point.

Using Terraform
# Existing FSx file system (example; replace with your actual resource or data source)
resource "aws_fsx_windows_file_system" "fsx_example" {
  storage_capacity    = 300
  subnet_ids          = [AWS_SUBNET_ID]          # replace with your subnet ID
  throughput_capacity = 32
  deployment_type     = "SINGLE_AZ_1"
  preferred_subnet_id = AWS_SUBNET_ID            # replace with your subnet ID
  security_group_ids  = [AWS_SECURITY_GROUP_ID]  # replace with your security group ID
  # ...other required arguments...
}

# Create a one-time manual FSx backup (recovery point), equivalent to:
# aws fsx create-backup --file-system-id {{asset_metadata.FileSystemId}} --region {{region_code}}
resource "aws_fsx_backup" "fsx_manual_backup" {
  file_system_id = aws_fsx_windows_file_system.fsx_example.id

  # Optional: add tags to identify this as a compliance backup
  tags = {
    Name        = "FSx Manual Compliance Backup"
    Environment = "ENVIRONMENT_NAME"  # replace with your environment name
  }
}

This change does not force replacement of the existing FSx file system; it only creates a new backup resource (which incurs storage costs and must be deleted manually when no longer needed, and may be redundant if AWS Backup already manages this file system).

Verification: terraform plan should show + create for aws_fsx_backup.fsx_manual_backup and no changes to the existing FSx file system.

Additional Reading:​