Description

Ensure that every Amazon Elastic File System (EFS) file system has automatic backups enabled. When automatic backups are enabled, the file system's backup policy is set to ENABLED and AWS Backup takes daily backups of the file system.

Rationale

Without backups, accidental deletion, ransomware or a misconfiguration can corrupt or destroy file system data with no way to recover it, affecting the availability and integrity of the data. Point-in-time backups allow data to be restored and support recovery objectives. Automatic backups should be enabled on every file system, with suitable retention, restricted delete and restore permissions, and regular restore tests.

Impact

  • Provides daily backups that can be used to restore lost or corrupted data

  • Backup storage is charged by AWS Backup

  • Enabling backups does not affect file system performance or clients

Default Value

When a file system is created in the Amazon EFS console, automatic backups are enabled by default. File systems created by other means may not have automatic backups enabled.

Pre-Requisites

  • IAM permissions: elasticfilesystem:DescribeFileSystems, elasticfilesystem:DescribeBackupPolicy and elasticfilesystem:PutBackupPolicy

  • Permission for AWS Backup to use its service-linked role, which is created automatically when automatic backups are first enabled

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EFS console and select File systems.

  3. Select each file system and check the Automatic backups setting in the General section.

  4. Repeat for each region in use.

  5. If automatic backups are not enabled for any file system, follow the implementation steps.

CLI:

List the file systems in a region:

aws efs describe-file-systems --region <REGION> --query "FileSystems[].[FileSystemId,Name]" --output table

Show the backup policy of a file system:

aws efs describe-backup-policy --file-system-id <FILE_SYSTEM_ID> --region <REGION>

A file system fails if Status is DISABLED or DISABLING, or if the command returns a PolicyNotFound error.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EFS console and select File systems.

  3. Select the file system and choose Edit.

  4. Select Enable automatic backups.

  5. Choose Save changes.

  6. Repeat for each affected file system in each region in use.

CLI:

Enable automatic backups for a file system:

aws efs put-backup-policy --file-system-id <FILE_SYSTEM_ID> --backup-policy Status=ENABLED --region <REGION>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EFS console and select File systems.

  3. Select the file system and choose Edit.

  4. Clear Enable automatic backups.

  5. Choose Save changes.

CLI:

aws efs put-backup-policy --file-system-id <FILE_SYSTEM_ID> --backup-policy Status=DISABLED --region <REGION>

Note: disabling automatic backups stops new backups; existing recovery points stay in the backup vault until they expire or are deleted. Without backups, lost data cannot be recovered.

Reference