# Ensure AWS Disaster Recovery Configuration

- Source: https://support.icompaas.com/support/solutions/articles/62000234545-ensure-aws-disaster-recovery-configuration
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Storage Services Benchmarks v1.0.0](https://support.icompaas.com/support/solutions/62000112689) › [CIS AWS Storage Services](https://support.icompaas.com/support/solutions/folders/62000169254)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   **Level 2**

### Description:

AWS Disaster Recovery configuration includes setting up AWS Elastic Disaster Recovery (EDR) to replicate critical workloads across regions or accounts. This setup ensures that mission-critical applications can be quickly recovered in case of region-wide outages, hardware failures, or data loss. Proper configuration involves enabling replication, assigning staging areas, configuring recovery settings, and validating DR readiness.

### Rationale:

Ensuring AWS Disaster Recovery is correctly configured provides:

-   Business continuity in the event of an outage or disaster  
    
-   Minimal downtime through rapid recovery  
    
-   Compliance with organizational RTO and RPO requirements  
    
-   A scalable and automated recovery environment for production systems  
    

### Default Value:

AWS Disaster Recovery is not configured by default. Setup must be manually performed via the AWS Console or CLI.

### Impact:

Pros:  
 • Enables recovery from data loss, outages, and hardware failures  
• Ensures continuity of operations for critical applications  
 • Reduces downtime through automation and replication

Cons:  
 • Requires upfront configuration and ongoing monitoring  
• May incur additional storage and replication costs  
 • Misconfiguration may lead to incomplete recovery or data inconsistency

### Pre-requisites:

IAM Permissions Required: drs:\*  
 ec2:\* (limited to snapshot, volume, network, and instance operations) s3:\*, iam:PassRole  
 Full access to source and recovery environments

### Remediation:

### Test Plan:

Using AWS Console:

1.  Log in to the AWS Management Console
2.  Navigate to Elastic Disaster Recovery (EDR)
3.  Verify that:

-   Source servers are added  
    
-   Replication is healthy (status: Continuous)  
    
-   Launch and replication settings are configured  
    
-   Recovery instances can be launched in test or actual recovery mode  
    • Review DR settings to confirm alignment with business policies  
    

Using AWS CLI:

aws drs describe-source-servers
aws drs get-replication-configuration \\
  --source-server-id s-xxxxxxxxxxxxxxxxx
aws drs get-launch-configuration \\
  --source-server-id s-xxxxxxxxxxxxxxxxx

### Implementation Plan:

Using AWS Console:

1.  Navigate to Elastic Disaster Recovery Console
2.  Add source servers and install the AWS Replication Agent
3.  Configure replication settings (e.g., staging area subnet, instance type)
4.  Configure launch settings (e.g., instance type, security group, subnet)
5.  Enable replication and verify that replication status is Healthy
6.  Test recovery by launching recovery instances in test mode

Using AWS CLI:

aws drs create-source-server \\
  --source-properties file://source.json
aws drs update-replication-configuration \\
  --source-server-id s-xxxxxxxxxxxxxxxxx \\
  --staging-area-subnet-id subnet-xxxxxxxx \\
  --replication-server-instance-type t3.medium
aws drs update-launch-configuration \\
  --source-server-id s-xxxxxxxxxxxxxxxxx \\
  --target-instance-type m5.large
aws drs start-recovery \\
  --source-server-ids s-xxxxxxxxxxxxxxxxx

### Backout Plan:

Using AWS Console:

1.  Terminate recovery instances
2.  Remove source servers from the EDR service
3.  Revert network, IAM, or replication settings as needed

Using AWS CLI:

aws drs terminate-recovery-instances \\
  --recovery-instance-ids ri-xxxxxxxxxxxxxxxxx
aws drs delete-source-server \\
  --source-server-id s-xxxxxxxxxxxxxxxxx

### References:

-   [https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html](https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html)
-    [https://docs.aws.amazon.com/cli/latest/reference/drs/](https://docs.aws.amazon.com/cli/latest/reference/drs/)
-   [https://aws.amazon.com/disaster-recovery/](https://aws.amazon.com/disaster-recovery/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.