An EBS volume is used as persistent block level storage on AWS’ Elastic Compute Cloud (EC2). As one of AWS’ growing advancements, EBS volumes are designed to hold very sensitive and critical data. Nonetheless, security is always a factor that comes into play, especially when dealing with production data that may be crucial to the life of the business.
1 – EBS Volume Encryption
Encryption is used to protect sensitive data from attackers or unauthorized personnel, so obviously in most cases, users prefer to have their data encrypted. In the AWS environment, data can be held in a number of places, two of which being the EBS volumes mentioned above, and S3 storage. Last month, AWS made two announcements. The first pertained to S3 users being able to use their own encryption keys, and the other opened the option of AWS users to encrypt their data on EBS volumes whilst using internal AWS encryption keys. AWS users are not yet able to provide and use their own encryption keys with EBS volumes due to the fact that the keys need to be present for all read/write operations.
Since EBS volumes are typically attached to instances (virtual machines), they need to be able to perform I/O operations at all times, therefore the keys need to be stored in AWS. Other encryption methods are not directly related to AWS EC2 instances or EBS volumes. Most of the modern file or operating systems offer some form of encryption, whether it be in Windows or Linux. These modules or methods are used to encrypt at the volume level, file system level, or even application level, and can prevent decryption from being possible if the volume somehow ends up in the wrong hands. Such an encryption layer ensures that nothing within the volume is readable to anyone without the proper software and encryption keys.
2 – Access Management (or How to Protect your EBS Volumes from Being Deleted)
Encryption acts as a solution to the problem of unauthorized individuals getting a hold of and using data. However, there are other ways for data to simply be deleted that have nothing to do with encryption. If EBS volumes are deleted, such as in the CodeSpaces story, you could lose your data along with your business. The Importance of IAM and MFA AWS’ identity and access management (IAM) feature should be used very carefully. Following one basic rule can help you steer clear of compromising situations: never give anyone access to your root credentials. If the correct permissions are not carefully assigned to every person involved in the business, security and operational performance may be jeopardized. For example, permitting a single user to delete EBS volumes as well as snapshots runs the risk of losing all of your valuable data and its backup that is stored in those locations. This is the exact kind of scenario that you are trying to avoid.
By using N2WS, we allow you to assign precise permissions to IAM users. With these specified credentials, you are able see the environment and manipulate snapshots (i.e. create, copy, and delete), but not delete volumes. This way, if someone gets hold of your specific credentials, they will be able to harm your cloud backup, but they won’t be able to touch your production. While this scenario is not exactly ideal, it is a less severe alternative to what might happen if all of your resources ended up in the wrong hands. Additionally, AWS offers their own best practice via Multi-Factor Authentication devices (MFA), which provide an extra layer of security for all of your AWS cloud resources, including EBS volumes. While data loss is not necessarily caused by someone trying to harm your data, the precautionary measures mentioned above are extremely valuable to keep your data safe on the cloud.
3 – The Art of Proper EBS Backup and Recovery
Proper storage and having multiple copies of data play a significant role in data recovery and protection. Therefore, it is very important to frequently update snapshots, so as to ensure that data can be adequately restored if necessary. Storing EBS snapshots in S3 is important due to the fact that S3 and EBS are based on separate infrastructures. Chances are that any outages that may occur will cover one, not both infrastructures. If something happens to the volume, the snapshots in S3 will most likely be alright.
Multiple Snapshots
Having multiple copies of EBS snapshots is good for a multitude of reasons. These include near seamless data recovery if snapshots are accidentally (or intentionally) deleted. For instance, you may want more than one copy of snapshots of critical volumes in case something happens to the original copy. This allows you to do one of two things. On one hand, storing the copy in the same region as the original, leaves you with two copies in case one is deleted by mistake. While on the other hand, you can put the original and its copy in separate regions for further protection.
Multiple AWS Accounts and Cloud Backup
Nowadays, It is simple to give external accounts permission to access, copy, and create volumes out of specified EBS snapshots. An additional important method that is used to protect your most critical EBS volumes is copying snapshots to separate AWS accounts. This allows you to have a `secured account` that can only be accessed by specific users of your choice. As a result, even if somehow your snapshots are wiped out from your first account, the separate account still holds the data. Once this is done, a copy of your snapshots is secured in a separate account that uses different credentials. While this is not so relevant to hybrid cloud options that incorporate on-premises and cloud solutions, it is very fitting for data that is solely kept on the cloud. If your data is split up between on-premises and cloud storage, it would be wise to copy the data so that all of it is located somewhere on the cloud, be it on the same cloud or a different cloud.
This is an extra means that could be used to further secure your data. All in all, it does not necessarily matter how many different places data is stored, but how secure each location is.
Efficient and Effective Recovery
Snapshots are useless unless they can be used for recovery. First and foremost, recovery drills should always be initially performed; you should never try to recover a volume or instance for the first time in a real data-loss scenario. You want to make sure that the environment in which your recovery operations run will bring your service back up, and keep it running and updating data as usual. Lastly, to further ensure efficient recovery, it is vital to learn and document all of the different manual steps that need to be taken.
Final Words
All in all as, as the cloud matures, so does the data that is migrated to and created on it. The AWS cloud serves large enterprises, public sector organizations, and a whole slew of other IT organizations. AWS’ EBS volumes hold these organizations’ and companies’ critical data, beginning with their production databases all the way to their actual files. Seeing as our vision is to protect data in the cloud, we, at N2W, continuously research and learn how the industry evolves and strive to support and create new ways to protect data.
