Storage Gateway Volumes Should Have Backup Plan

​

More Info:

This rule checks if AWS Storage Gateway volumes are protected by a backup plan. The rule is NON_COMPLIANT if the Storage Gateway volume is not covered by a backup plan.

​

Risk Level

High

​

Address

Configuration

​

Compliance Standards

CBP

​

Remediation

​

Using Console

To remediate the misconfiguration of Storage Gateway volumes not having a backup plan in AWS EC2 using the AWS console, follow these steps:

1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/) and login with your credentials.

2. Navigate to Storage Gateway: In the AWS Management Console, search for “Storage Gateway” in the services search bar, and click on the Storage Gateway service.

3. Select the Gateway: Select the Storage Gateway that is associated with the EC2 instance for which you want to create a backup plan.

4. Create a Backup Plan:

   • Click on the “Volumes” tab in the Storage Gateway console.
   • Select the volume for which you want to create a backup plan.
   • Under the “Actions” dropdown menu, select “Create EBS Snapshot Schedule”.
   • Configure the backup schedule according to your requirements, such as frequency, retention policy, and start time.
   • Click on “Create” to save the backup plan.

5. Monitor the Backup Plan:

   • Once the backup plan is created, you can monitor its status and view the backup history in the Storage Gateway console.
   • Ensure that the backup plan is running as per the configured schedule and that backups are being created successfully.

6. Verify Backup Data:

   • Periodically verify the backup data to ensure that it can be restored in case of any data loss or disaster.

By following these steps, you can remediate the misconfiguration of Storage Gateway volumes not having a backup plan for your AWS EC2 instance using the AWS console.

​

Using CLI

To remediate the misconfiguration of Storage Gateway volumes not having a backup plan in AWS EC2 using AWS CLI, you can follow these steps:

1. List Storage Gateway Volumes: First, list all the Storage Gateway volumes in your AWS account to identify the volumes that do not have a backup plan. You can use the following AWS CLI command:

   aws storagegateway list-volumes
   

2. Enable Backup Plan: For each volume that does not have a backup plan, you will need to enable a backup plan. You can use the following AWS CLI command to enable a backup plan for a specific volume:

   aws storagegateway update-vtl-vtldevice-type -i <VOLUME_ARN> --vtl-device-type "VTL" --vtl-device-iSCSI-Settings "TargetARN=<TARGET_ARN>,NetworkInterfaceId=<NETWORK_INTERFACE_ID>,InitiatorName=<INITIATOR_NAME>"
   

   • Replace <VOLUME_ARN> with the ARN of the volume that needs a backup plan.
   • Replace <TARGET_ARN> with the ARN of the target where the volume backups will be stored.
   • Replace <NETWORK_INTERFACE_ID> with the ID of the network interface for the volume.
   • Replace <INITIATOR_NAME> with the initiator name for the volume.

3. Monitor Backup Plan: Once you have enabled a backup plan for the volumes, monitor the backup status regularly to ensure that the backups are being performed successfully. You can use the following AWS CLI command to describe the backup status of a volume:

   aws storagegateway describe-vtl-devices
   

By following these steps, you can remediate the misconfiguration of Storage Gateway volumes not having a backup plan in AWS EC2 using AWS CLI.

​

Using Python

To remediate the misconfiguration of Storage Gateway Volumes not having a backup plan in AWS EC2 using Python, you can follow these steps:

1. Import the necessary libraries:

import boto3

2. Initialize the AWS EC2 client:

ec2_client = boto3.client('ec2')

3. Retrieve a list of Storage Gateway volumes:

response = ec2_client.describe_volumes(Filters=[{'Name': 'volume-type', 'Values': ['gateway']}])

4. For each volume, check if a backup plan is already configured. If not, create a backup plan using AWS Backup service:

backup_client = boto3.client('backup')

for volume in response['Volumes']:
    volume_arn = volume['VolumeArn']
    
    # Check if backup plan is already configured
    try:
        response = backup_client.get_recovery_point_restore_metadata(ResourceArn=volume_arn)
    except backup_client.exceptions.ResourceNotFoundException:
        # Create a backup plan if not already configured
        backup_plan = {
            'BackupPlanName': 'BackupPlanForVolume_' + volume['VolumeId'],
            'BackupPlanRule': {
                'RuleName': 'DefaultBackupRule',
                'TargetBackupVaultName': 'Default'
            }
        }
        response = backup_client.create_backup_plan(BackupPlan=backup_plan)

5. Implement appropriate error handling and logging as needed.

By following these steps and running the Python script, you can remediate the misconfiguration of Storage Gateway Volumes not having a backup plan in AWS EC2.