Cis AWS Storage 2.12
DevOps & Securitycis-aws-storage-2.12Cis AWS Storage 2.12 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure Monitoring EC2 and EBS with CloudWatch
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Storage_Services_Benchmark_v1.0.0/cis-aws-storage-2.12/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-storage-2-12, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS Control 2.12: Ensure Monitoring EC2 and EBS with CloudWatch (Manual)
Profile Applicability
- Level 2
Description
CloudWatch is an AWS monitoring service that allows you to keep an eye on your AWS resources. You can track metrics via files or worldclass data visuals. AWS CloudWatch allows the administrator to keep an eye on his/her AWS resources. You can set up alarms, monitor activity, and analyze log data. CloudWatch is a must to keep your AWS EBS and EC2 resources secure.
Rationale
Using CloudWatch to monitor EC2 instances and EBS volumes is essential for enhancing operational oversight and ensuring optimal performance within the AWS environment. This approach provides real-time insights into resource usage and system health, enabling proactive adjustments and timely responses to potential issues, thereby maintaining high availability and efficiency.
Impact
Failing to monitor EC2 instances and EBS volumes with CloudWatch can lead to delayed detection of performance issues and resource bottlenecks, potentially causing system outages and degraded user experiences. Without this monitoring, organizations also miss opportunities for proactive optimizations, increasing the risk of unexpected downtime and higher operational costs.
Audit Procedure
Creating an AWS CloudWatch Dashboard - see pages 53-54 of CIS AWS Storage Services Benchmark v1.0.0.
Remediation
- Enable CloudWatch Monitoring
- Configure CloudWatch Alarms
- Establish Baselines
- Automate Responses
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.2 Collect Audit Logs | ● | ● | ● |
| v7 | 6.2 Activate audit logging | ● | ● | ● |
| v7 | 6.5 Central Log Management | ● | ● |