> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Storage Gateway Recovery Point Should Be Created ### More Info: This rule checks if a recovery point was created for Amazon Relational Database Service (Amazon RDS). The rule is NON\_COMPLIANT if the Amazon RDS instance does not have a corresponding recovery point ### Risk Level High ### Address Configuration ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of not having Storage Gateway Recovery Point created for AWS EC2 using the AWS console, follow these step-by-step instructions: 1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to your AWS account. 2. **Navigate to AWS Storage Gateway**: Go to the AWS Management Console and search for "Storage Gateway" in the services search bar. 3. **Select your Storage Gateway**: In the Storage Gateway console, select the Storage Gateway that is associated with your EC2 instance. 4. **Create a Recovery Point**: Within the Storage Gateway console, navigate to the "Volumes" section and select the volume that is associated with your EC2 instance. 5. **Initiate a Snapshot**: In the volume details page, locate the option to create a recovery point or snapshot. Click on the "Create Snapshot" or "Create Recovery Point" button. 6. **Configure Snapshot settings**: Follow the on-screen instructions to configure the snapshot settings, such as the snapshot description, frequency, and retention period. 7. **Review and Confirm**: Review the snapshot settings to ensure they meet your requirements, then click on the "Create Snapshot" or "Create Recovery Point" button to initiate the snapshot creation process. 8. **Monitor Snapshot Creation**: Monitor the snapshot creation process in the Storage Gateway console. Once the snapshot is successfully created, you have now remediated the misconfiguration of not having a Storage Gateway Recovery Point created for your AWS EC2 instance. By following these steps, you have successfully remediated the misconfiguration of not having a Storage Gateway Recovery Point created for your AWS EC2 instance using the AWS console. # To remediate the misconfiguration of not having Storage Gateway Recovery Point created for AWS EC2 using AWS CLI, you can follow these steps: 1. **Install and Configure AWS CLI:** If you haven't already, install and configure the AWS Command Line Interface (CLI) on your local machine. You can refer to the official AWS documentation for instructions on how to do this. 2. **Enable Storage Gateway for EC2 Instance:** Ensure that the AWS Storage Gateway service is enabled for the specific EC2 instance that requires a Recovery Point. You can do this by navigating to the AWS Management Console, selecting the EC2 service, choosing the specific instance, and enabling the Storage Gateway service. 3. **Create a Recovery Point using AWS CLI:** Use the AWS CLI to create a Recovery Point for the Storage Gateway associated with the EC2 instance. You can use the following command to create a Recovery Point: ```bash theme={null} aws storagegateway create-snapshot-from-volume-recovery-point --volume-arn ``` Replace `` with the Amazon Resource Name (ARN) of the volume associated with the EC2 instance. 4. **Verify the Recovery Point:** After executing the command, verify that the Recovery Point has been successfully created by checking the AWS Storage Gateway console or by running the following command: ```bash theme={null} aws storagegateway list-volume-recovery-points --gateway-arn ``` Replace `` with the ARN of the Storage Gateway associated with the EC2 instance. 5. **Set up Automated Recovery Point Creation (Optional):** To ensure that Recovery Points are created regularly, you can set up a scheduled task or automation using AWS CloudWatch Events or AWS Lambda to trigger the creation of Recovery Points at specified intervals. By following these steps, you can successfully remediate the misconfiguration of not having Storage Gateway Recovery Points created for the AWS EC2 instance using AWS CLI. To remediate the misconfiguration of not having Storage Gateway recovery points created for AWS EC2 instances using Python, you can follow these steps: 1. Install the AWS SDK for Python (Boto3) by running the following command: ``` pip install boto3 ``` 2. Create a Python script to automate the process of creating recovery points for the AWS Storage Gateway. Below is a sample script that you can use: ```python theme={null} import boto3 # Initialize the AWS service clients client = boto3.client('storagegateway') # Specify the Gateway ARN for the Storage Gateway that is associated with the EC2 instance gateway_arn = 'YOUR_GATEWAY_ARN' # Create a recovery point for the specified Gateway ARN response = client.create_tape_recovery_point( GatewayARN=gateway_arn ) # Print the response print(response) ``` 3. Replace `'YOUR_GATEWAY_ARN'` with the actual ARN of the Storage Gateway that is associated with the EC2 instance. 4. Run the Python script to create a recovery point for the specified Storage Gateway. This will ensure that recovery points are created for the EC2 instance. By following these steps and running the Python script, you can remediate the misconfiguration of not having Storage Gateway recovery points created for AWS EC2 instances. ```hcl theme={null} # Creating a one-time Storage Gateway snapshot (recovery point) is a runtime API # action (`aws storagegateway create-snapshot`) and is NOT managed as a persistent # Terraform resource. Terraform cannot represent “create this single snapshot once” # without trying to recreate it on every apply. # You must perform the verified remediation outside Terraform, e.g.: # aws storagegateway create-snapshot \ # --volume-arn STORAGE_GATEWAY_VOLUME_ARN_HERE \ # --snapshot-description "Manual snapshot for volume ASSET_LABEL_HERE created for compliance." \ # --region AWS_REGION_HERE # Then, if you want ongoing automated protection in Terraform, configure a backup # plan (e.g., aws_backup_plan / aws_backup_selection) for the relevant resources. # No Terraform resource is available that directly models this one-time # `create-snapshot` operation for Storage Gateway volumes. ``` After running the CLI command, `terraform plan` should show no changes related to this one-time snapshot, because it is not represented in Terraform state. ### Additional Reading: * [https://docs.aws.amazon.com/config/latest/developerguide/rds-last-backup-recovery-point-created.html](https://docs.aws.amazon.com/config/latest/developerguide/rds-last-backup-recovery-point-created.html)