# Ensure Proper IAM Configuration for AWS Elastic Disaster Recovery

- Source: https://support.icompaas.com/support/solutions/articles/62000234542-ensure-proper-iam-configuration-for-aws-elastic-disaster-recovery
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Storage Services Benchmarks v1.0.0](https://support.icompaas.com/support/solutions/62000112689) › [CIS AWS Storage Services](https://support.icompaas.com/support/solutions/folders/62000169254)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   **Level 2**

### Description:

AWS Elastic Disaster Recovery (EDR) requires specific IAM roles and policies to securely perform replication, recovery, and failback operations. Proper IAM configuration ensures that the service can access required AWS resources, and that access is limited to only what is necessary, following the principle of least privilege.

### Rationale:

Proper IAM configuration ensures:

-   AWS EDR can perform replication and launch recovery instances  
    
-   Security best practices are followed by applying least-privilege principles  
    
-   Auditing and compliance controls are maintained  
    
-   Failovers, drills, and failbacks function without permission errors  
    

### Default Value:

By default, some roles may be auto-created during setup, but they may not meet organizational security policies. Manual validation and fine-tuning is recommended.

### Impact:

Pros:  
 • Enables smooth functioning of EDR operations  
• Prevents unauthorized access to recovery infrastructure  
 • Supports compliance with IAM governance standards

Cons:  
 • Requires understanding of IAM policy structure  
• Misconfiguration may cause replication or failover failures  
 • Needs periodic review to align with changing security requirements

### Pre-requisites:

IAM Permissions Required: iam:CreateRole, iam:PutRolePolicy, iam:AttachRolePolicy, iam:PassRole  
 drs:\*  
 Administrator access or delegated security management role

### Remediation:

### Test Plan:

Using AWS Console:

1.   Log in to the AWS Management Console
2.  Navigate to IAM > Roles
3.  Search for roles starting with AWS-ElasticDisasterRecovery-\*
4.  Open each role and review attached policies
5.  Confirm the presence of AWSElasticDisasterRecoveryRecoveryInstancePolicy, AWSElasticDisasterRecoveryReplicationServerPolicy, and trusted relationships
6.  Ensure no excessive permissions are included

Using AWS CLI:

aws iam list-roles
aws iam list-attached-role-policies \\
  --role-name AWS-ElasticDisasterRecovery-ReplicationServerRole
aws iam get-role \\
  --role-name AWS-ElasticDisasterRecovery-ReplicationServerRole

### Implementation Plan:

Using AWS Console:

1.  Navigate to IAM > Policies, click Create policy
2.   Define a custom least-privilege policy for specific access needs
3.   Navigate to IAM > Roles, create or edit EDR roles
4.  Attach managed policies like AWSElasticDisasterRecoveryReplicationServerPolicy
5.  Define trusted entities (e.g., drs.amazonaws.com) in the trust relationship
6.  Save and verify that the role is used in EDR settings

Using AWS CLI:  
 Step 1: Create a trust policy JSON (trust-policy.json):

{
  "Version": "2012-10-17",
  "Statement": \[
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "drs.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  \]
}

Step 2: Create the role:

aws iam create-role \\
  --role-name AWS-ElasticDisasterRecovery-ReplicationServerRole \\
  --assume-role-policy-document file://trust-policy.json

Step 3: Attach the managed policy:

aws iam attach-role-policy \\
  --role-name AWS-ElasticDisasterRecovery-ReplicationServerRole \\
  --policy-arn arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReplicationServerPolicy

### Backout Plan:

Using AWS Console:

1.  Revert trust relationships or remove permissions from IAM roles
2.  Detach or delete custom policies that exceed least-privilege

Using AWS CLI:

aws iam detach-role-policy \\
  --role-name AWS-ElasticDisasterRecovery-ReplicationServerRole \\
  --policy-arn arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReplicationServerPolicy
aws iam delete-role \\
  --role-name AWS-ElasticDisasterRecovery-ReplicationServerRole

### References:

-   [https://docs.aws.amazon.com/drs/latest/userguide/setting-up.html](https://docs.aws.amazon.com/drs/latest/userguide/setting-up.html)
-    [https://docs.aws.amazon.com/IAM/latest/UserGuide/access\_policies.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/](https://docs.aws.amazon.com/cli/latest/reference/iam/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.