Skip to main content

More Info:

This rule checks if a backup plan has a backup rule that satisfies the retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.

Risk Level

High

Address

Configuration

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using the AWS console, follow these steps:
  1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and login using your credentials.
  2. Navigate to AWS Backup Service: In the AWS Management Console, search for “Backup” in the services search bar and click on “Backup” under the “Storage” category.
  3. Select Backup Plans: In the AWS Backup console, click on “Backup plans” in the left-hand navigation pane.
  4. Edit Backup Plan: Find the backup plan that needs to have a retention period set and click on the plan name to select it.
  5. Add Retention Period: In the details of the backup plan, locate the section where you can set the retention period. Click on the “Edit” button next to the retention settings.
  6. Set Retention Period: Enter the desired retention period in days for the backups to be retained. This can vary depending on your organization’s retention policies.
  7. Save Changes: After setting the retention period, click on the “Save” or “Update” button to save the changes to the backup plan.
  8. Verify Configuration: Double-check the backup plan details to ensure that the retention period has been successfully set.
By following these steps, you have successfully remediated the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using the AWS console.

To remediate the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using AWS CLI, follow these steps:
  1. List Backup Plans: First, list all the existing backup plans to identify the one that needs to be updated. You can use the following AWS CLI command:
  2. Update Backup Plan: Once you have identified the backup plan that needs to be updated, you can use the following AWS CLI command to update the backup plan with a retention period:
    Replace <backup-plan-id> with the ID of the backup plan that needs to be updated and <retention-period> with the number of days you want to retain the backups.
  3. Verify: Finally, verify that the retention period has been set successfully by listing the details of the updated backup plan using the following AWS CLI command:
    This command will display the details of the backup plan, including the retention period for EC2 resources.
By following these steps, you can remediate the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using AWS CLI.
To remediate the misconfiguration of not having a retention period set for the backup plan in AWS EC2 using Python, you can follow these steps:
  1. Install the AWS SDK for Python (Boto3) if you haven’t already. You can install it using pip:
  2. Write a Python script to update the backup plan with the desired retention period. Here is an example script to set a retention period of 30 days for a backup plan in AWS EC2:
  1. Replace 'your_backup_plan_id_here' with the actual Backup Plan Id that you want to update.
  2. Replace 'YourBackupPlanName' with the name of your backup plan.
  3. Run the Python script to update the backup plan with the specified retention period.
After running this script, the backup plan in AWS EC2 will be updated with the specified retention period, ensuring that backups are retained for the desired duration.
This mirrors the CLI fix by adding/modifying the lifecycle block in the backup rule and setting delete_after (e.g., 35) to enforce the retention period in days; it updates the existing plan in place and does not force replacement of the backup vault or plan, only a configuration change to the rule.To verify, terraform plan should show an in-place update to aws_backup_plan.EC2_BACKUP_PLAN with a change adding or modifying lifecycle.delete_after to DESIRED_RETENTION_DAYS.

Additional Reading: