FSx Should Have Recovery Point Within Specified Duration

More Info:

This rule checks if a recovery point was created for Amazon FSx File Systems. The rule is NON_COMPLIANT if the Amazon FSx File System does not have a corresponding recovery point created within the specified time period.

Risk Level

High

Address

Configuration

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of FSx not having a recovery point for AWS EC2 using the AWS console, follow these steps:

Navigate to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/).
Open Amazon FSx Console: Click on the "Services" dropdown menu at the top left corner, search for "FSx", and click on "Amazon FSx".
Select FSx File System: In the Amazon FSx dashboard, select the FSx file system that you want to create a recovery point for by clicking on it.
Create Recovery Point: In the FSx file system details page, navigate to the "Data repositories" tab and click on the "Create backup" button.
Configure Backup: In the "Create backup" wizard, configure the backup settings such as backup type (daily or weekly), retention period, and preferred backup window.
Review and Create: Review the backup settings to ensure they meet your requirements, then click on the "Create backup" button to initiate the creation of a recovery point for the FSx file system.
Monitor Backup Progress: Monitor the progress of the backup creation in the Amazon FSx console. Once the backup is successfully created, you will have a recovery point for your FSx file system.

By following these steps, you have successfully remediated the misconfiguration of FSx not having a recovery point for your AWS EC2 instance using the AWS console.

Using CLI

To remediate the misconfiguration of FSx not having a recovery point for AWS EC2 using AWS CLI, you can follow these steps:

Create a Backup for FSx File System:
- Use the create-backup command to create a backup for the FSx file system.
```
aws fsx create-backup --file-system-id fs-1234567890abcdef0 --tags Key=Name,Value=Backup1
```
- Replace fs-1234567890abcdef0 with the actual File System ID of your FSx file system.
Verify Backup Status:
- Use the describe-backups command to check the status of the backup.
```
aws fsx describe-backups --backup-ids backup-0abcdef1234567890
```
- Replace backup-0abcdef1234567890 with the Backup ID of the backup created in the previous step.
Enable Automatic Backups (Optional):
- To ensure that automatic backups are enabled for future backups, you can use the update-file-system command.
```
aws fsx update-file-system --file-system-id fs-1234567890abcdef0 --lustre-configuration WeeklyMaintenanceStartTime=1:00:00
```
- Replace fs-1234567890abcdef0 with the actual File System ID of your FSx file system.

By following these steps, you can remediate the misconfiguration of FSx not having a recovery point for your AWS EC2 instance using AWS CLI.

Using Python

To remediate the misconfiguration related to Amazon FSx not having a Recovery Point for AWS EC2 using Python, you can follow these steps:

Install Boto3: Boto3 is the Amazon Web Services (AWS) SDK for Python. You can install it using pip:
```
pip install boto3
```
Create a Python script: Create a Python script with the following code to enable automatic backups (recovery points) for the Amazon FSx file system associated with your EC2 instance.

import boto3

# Initialize the Boto3 client for FSx
fsx_client = boto3.client('fsx', region_name='your_aws_region')

# Specify the ID of the FSx file system associated with your EC2 instance
fsx_file_system_id = 'your_fsx_file_system_id'

# Enable automatic backups for the FSx file system
response = fsx_client.update_file_system(
    FileSystemId=fsx_file_system_id,
    LustreConfiguration={
        'WeeklyMaintenanceStartTime': '1:00:00',
        'DataRepositoryConfiguration': {
            'AutoImportPolicy': 'NONE',
            'ExportPath': 'string',
            'ImportPath': 'string'
        }
    },
    WindowsConfiguration={
        'WeeklyMaintenanceStartTime': '1:00:00',
        'AutomaticBackupRetentionDays': 30,
        'DailyAutomaticBackupStartTime': '1:00:00',
        'ThroughputCapacity': 8,
        'SelfManagedActiveDirectoryConfiguration': {
            'UserName': 'string',
            'Password': 'string',
            'DnsIps': [
                'string',
            ]
        }
    }
)

print("Automatic backups enabled for FSx file system with ID:", fsx_file_system_id)

Replace placeholders: Replace 'your_aws_region' with the AWS region where your FSx file system is located, and 'your_fsx_file_system_id' with the actual ID of your FSx file system.
Run the script: Execute the Python script in your local environment or on an EC2 instance with appropriate IAM roles that have permissions to modify FSx configurations.

This script will enable automatic backups for the specified Amazon FSx file system associated with your EC2 instance, ensuring that a recovery point is available in case of data loss or corruption.

Using Terraform

# FSx manual backup to create a current recovery point
resource "aws_fsx_backup" "FSX_MANUAL_BACKUP" {
  file_system_id = aws_fsx_lustre_file_system.FSX_FILE_SYSTEM.id
  # For Windows or OpenZFS, replace the reference above with:
  # file_system_id = aws_fsx_windows_file_system.FSX_FILE_SYSTEM.id
  # or:
  # file_system_id = aws_fsx_openzfs_file_system.FSX_FILE_SYSTEM.id

  tags = {
    Name        = "MANUAL_BACKUP_FOR_COMPLIANCE"
    Environment = "REPLACE_WITH_ENVIRONMENT_TAG"
  }
}

# Example FSx file system this backup is created from
resource "aws_fsx_lustre_file_system" "FSX_FILE_SYSTEM" {
  storage_capacity          = 1200
  subnet_ids                = [aws_subnet.FSX_SUBNET.id]
  deployment_type           = "PERSISTENT_1"
  per_unit_storage_throughput = 50
  security_group_ids        = [aws_security_group.FSX_SG.id]

  tags = {
    Name = "REPLACE_WITH_FSX_NAME"
  }
}

Substitute:

REPLACE_WITH_ENVIRONMENT_TAG with your environment label (e.g. prod).
REPLACE_WITH_FSX_NAME with your FSx file system name.
aws_subnet.FSX_SUBNET and aws_security_group.FSX_SG with your existing subnet and security group resources.
If you use FSx for Windows/OpenZFS instead of Lustre, switch the aws_fsx_lustre_file_system block to the appropriate FSx resource and update the file_system_id reference accordingly.

This change does not force replacement of the existing FSx file system; it only creates a new backup resource. Backup creation is asynchronous in AWS, but Terraform will wait for the backup to reach an available state before completing.

Verification: terraform plan should show an aws_fsx_backup.FSX_MANUAL_BACKUP resource with + create (1 to add, 0 to change, 0 to destroy).

Additional Reading:

https://docs.aws.amazon.com/config/latest/developerguide/fsx-last-backup-recovery-point-created.html

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​