Missing Snapshots For EBS Volumes

Risk level: Medium (should be achieved)

Rule ID: EC2-002

An EBS snapshot is a point-in-time copy of your Amazon EBS volume, which is copied to Amazon Simple Storage Service (Amazon S3). EBS snapshots are incremental copies of data. This means that only unique blocks of EBS volume data that have changed since the last EBS snapshot are stored in the next EBS snapshot.

Creating point-in-time EBS snapshots periodically will allow you to handle efficiently your data recovery process in the event of a failure, save your data before shutting down an EC2 instance, back up data for geographical expansion, and maintain your disaster recovery stack up to date.

This rule can help you with the following compliance standards:

Audit

To determine if you have snapshots available for your EBS volumes, perform the following:

 

Using AWS Console

1. Log in to the AWS Management Console.
 
2. Navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/.
 
3. In the navigation panel, under Elastic Block Store, click Volumes.
 
4. Select the EBS volume that you need to examine.
 
5. Select the Description tab from the bottom panel.
 
6. Check for a value in the Snapshot field. An empty value means that the volume is not backed up and there are no automatic or manual snapshots being taken.
 

 
 
7. Repeat steps no. 4, 5, and 6 for each EBS volume available in the current region. Change the AWS region from the navigation bar to audit volumes in another region.
 

Using AWS CLI

1. Run describe-volumes command (OSX/Linux/UNIX) with volume-ids to determine if your EBS volumes have snapshots created or not.

aws ec2 describe-volumes \\
--volume-ids vol-001ad867372f9610c \\
--query Volumes[0].SnapshotId

 
2. The command output should reveal the snapshotId if you have a snapshot available. Otherwise, the output will be a blank string.
 
3. A Blank string indicates that there is no snapshot available and hence you must create one to ensure you have backup available for your data in case of a disaster.

Remediation / Resolution

To maintain your EBS backup stack up-to-date, you need to create new EBS snapshots. You can either take a snapshot manually or you can even define a Snapshot lifecycle to schedule an automatic snapshot on a daily basis. This document outlines only manual snapshot creation process. In order to get details about how to automate the creation, retention, copy and deletion of EBS snapshots and EBS-backed AMIs, please get in-touch with our friendly team.

 

Using AWS Console

1. Log in to the AWS Management Console.
 
2. Navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/.
 
3. In the navigation panel, under Elastic Block Store, click Volumes.
 
4. Select the EBS volume that you need to back up.
 
5. Click the Actions dropdown button from the dashboard top menu and select Create Snapshot.
 

 
6. In the Create Snapshot dialog box, provide a name and a description for the volume snapshot and click Create.
 
7. Repeat steps no. 4, 5, and 6 for each EBS volume (available or in-use) without snapshot within the current region. Change the AWS region from the navigation bar to fix volumes in another region.
 

Using AWS CLI

1. Run create-snapshot command (OSX/Linux/UNIX) to create a new snapshot from your selected volume (regardless the volume encryption status). The following example use an EBS volume with the ID vol-78ad1aa9:

aws ec2 create-snapshot \\
--volume-id vol-78ad1aa9

 
2. The command output should return the new EBS snapshot metadata. The current state for the snapshot should be pending:

{
    "Description": "",
    "Encrypted": false,
    "VolumeId": "vol-78ad1aa9",
    **"State": "pending",**
    "VolumeSize": 15,
    "Progress": "",
    "StartTime": "2016-04-18T13:33:50.000Z",
    "SnapshotId": "snap-009d1314",
    "OwnerId": "123456789012"
}

 
3. Run describe-snapshots command (OSX/Linux/UNIX) to determine the state of the newly created snapshot:

aws ec2 describe-snapshots \\
--snapshot-id snap-009d1314

 
4. The command output should return the current snapshot state. If the State parameter value is completed, the EBS volume snapshot has been successfully created.

{
    "Snapshots": [
        {
            "Description": "",
            "Encrypted": false,
            "VolumeId": "vol-78ad1aa9",
            **"State": "completed",**
            "VolumeSize": 15,
            "Progress": "100%",
            "StartTime": "2016-04-18T13:33:50.000Z",
            "SnapshotId": "snap-009d1314",
            "OwnerId": "123456789012"
        }
    ]
}

 

Still Need Help?

Come see why we are the #1 cloud management platform and why companies like Uber, Dickey’s BBQ Pit and Norwegian Cruise Line trust nOps to manage their cloud.