Profile Applicability:
 • Level 2

Description:

Creating a new Amazon Elastic Block Store (EBS) volume provides scalable, persistent block storage for EC2 instances. EBS volumes are ideal for storing data that must persist even if the EC2 instance is stopped or terminated. Creating and attaching EBS volumes to instances ensures data durability and easy scaling of storage as required.

Rationale:

By creating new volumes, organizations can expand storage capacity for EC2 instances without interrupting service. EBS volumes provide flexibility, scalability, and persistence that is essential for applications that require high-availability and data durability, such as databases, application logs, and persistent application states.

Impact:

Pros:

  • Provides persistent storage for EC2 instances

  • Scalable storage solution based on needs

  • Allows for data snapshots and backups

  • Offers high availability and durability with replication across availability zones

Cons:

  • Additional cost for storage volume

  • Requires proper volume management to ensure efficient use of resources

  • Misconfigured volumes (e.g., insufficient IOPS or size) could lead to performance bottlenecks

Default Value:

EBS volumes are not created by default; they must be created and attached during instance setup or afterward.

Pre-requisites:

  • IAM permissions to create and manage EBS volumes

  • EC2 instance running or available for volume attachment

  • Clear understanding of the storage needs (size, IOPS, type) for the application

Remediation

Test Plan

Using AWS Console:

  1. Sign in to the AWS Management Console

  2. Navigate to EC2 > Volumes

  3. Verify that the new EBS volume has been created

  4. Check the volume’s size, IOPS, and type to ensure it meets the application’s requirements

  5. Ensure that the volume is correctly attached to an EC2 instance

  6. Verify encryption settings (if required)

  7. Confirm the volume’s availability zone matches the EC2 instance’s zone

Using AWS CLI:

  1. List all volumes:

     aws ec2 describe-volumes


  2. Describe the specific volume by ID:

     aws ec2 describe-volumes --volume-ids <volume-id>


  3. Verify the volume’s attributes such as size, IOPS, type, and encryption:

    aws ec2 describe-volumes --volume-id <volume-id> --query "Volumes[0].{Size:Size,Type:VolumeType,Iops:Iops,Encrypted:Encrypted}"

Implementation Plan

Using AWS Console:

  1. Sign in to the AWS Management Console

  2. Navigate to EC2 > Volumes

  3. Click Create Volume

  4. Select the Volume Type (e.g., General Purpose SSD, Provisioned IOPS SSD, etc.)

  5. Set the Size (in GB), IOPS, and Availability Zone

  6. Choose Encryption (if required)

  7. Review and click Create Volume

  8. After creation, navigate to Actions > Attach Volume

  9. Select the EC2 instance to attach the volume

  10. Click Attach

Using AWS CLI:

Create a new volume with specified size and type:

aws ec2 create-volume \
  --size 20 \
  --volume-type gp2 \
  --availability-zone <az-name> \
  --encrypted \
  --iops 100

Attach the newly created volume to an EC2 instance:

aws ec2 attach-volume \
  --volume-id <volume-id> \
  --instance-id <instance-id> \
  --device /dev/sdf

Backout Plan

Using AWS Console:

  1. Navigate to EC2 > Volumes

  2. Select the volume to detach

  3. Click Detach Volume

  4. Optionally, delete the volume if no longer needed

  5. If necessary, recreate a new volume with the correct configuration

Using AWS CLI:

  1. Detach the volume from the EC2 instance:

     aws ec2 detach-volume --volume-id <volume-id>


  2. Optionally, delete the volume:

    Ensure the Creation of a New Volume (Manual)


References: