AWS prescriptive-guidance medium security documentation change
Summary
Updated terminology to use full product names (e.g., 'Amazon EBS' instead of 'EBS'), removed redundant 'Technology stack' section, corrected documentation links, and made minor formatting adjustments
Security assessment
The documentation explicitly states that deleting unused EBS volumes is a security best practice to prevent access to potentially sensitive data. While primarily about cost optimization, the security justification for deleting unused resources with sensitive data makes this security-related.
Diff
diff --git a/prescriptive-guidance/latest/patterns/delete-unused-amazon-elastic-block-store-amazon-ebs-volumes-by-using-aws-config-and-aws-systems-manager.md b/prescriptive-guidance/latest/patterns/delete-unused-amazon-elastic-block-store-amazon-ebs-volumes-by-using-aws-config-and-aws-systems-manager.md index 59f1f95a9..e1114806c 100644 --- a//prescriptive-guidance/latest/patterns/delete-unused-amazon-elastic-block-store-amazon-ebs-volumes-by-using-aws-config-and-aws-systems-manager.md +++ b//prescriptive-guidance/latest/patterns/delete-unused-amazon-elastic-block-store-amazon-ebs-volumes-by-using-aws-config-and-aws-systems-manager.md @@ -7 +7 @@ SummaryPrerequisites and limitationsArchitectureToolsEpicsTroubleshootingRelated -# Delete unused Amazon Elastic Block Store (Amazon EBS) volumes by using AWS Config and AWS Systems Manager +# Delete unused Amazon EBS volumes by using AWS Config and AWS Systems Manager @@ -13 +13 @@ SummaryPrerequisites and limitationsArchitectureToolsEpicsTroubleshootingRelated -The lifecycle of an Amazon Elastic Block Store (Amazon EBS) volume is typically independent from the lifecycle of the Amazon Elastic Compute Cloud (Amazon EC2) instance to which it is attached. Unless you select **Delete on Termination** option at the time of launch, terminating the EC2 instance detaches the EBS volume but doesn’t delete it. Especially in development and testing environments where it’s common to launch and terminate EC2 instances, this can result in a large number of unutilized EBS volumes. EBS volumes accrue charges in your Amazon Web Services (AWS) account, regardless of whether they’re being used. Deleting these volumes can help you optimize costs for your AWS accounts. In addition, deleting unused EBS volumes is a security best practice to prevent access to any unused, potentially sensitive, data in those volumes. +The lifecycle of an Amazon Elastic Block Store (Amazon EBS) volume is typically independent from the lifecycle of the Amazon Elastic Compute Cloud (Amazon EC2) instance to which it is attached. Unless you select **Delete on Termination** option at the time of launch, terminating the Amazon EC2 instance detaches the Amazon EBS volume but doesn’t delete it. Especially in development and testing environments where it’s common to launch and terminate Amazon EC2 instances, this can result in a large number of unutilized Amazon EBS volumes. Amazon EBS volumes accrue charges in your AWS account, regardless of whether they’re being used. Deleting these volumes can help you optimize costs for your AWS accounts. In addition, deleting unused Amazon EBS volumes is a security best practice to prevent access to any unused, potentially sensitive, data in those volumes. @@ -23 +23 @@ AWS Config can help you manually or automatically remediate noncompliant resourc - * AWS Identity and Access Management (IAM) permissions to run the `AWSConfigRemediation-DeleteUnusedEBSVolume` runbook for Automation, a capability of AWS Systems Manager. For more information, see _Required IAM permissions_ in [AWSConfigRemediation-DeleteUnusedEBSVolume](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-delete-ebs-volume.html). + * AWS Identity and Access Management (IAM) permissions to run the `AWSConfigRemediation-DeleteUnusedEBSVolume` runbook for Automation, a capability of Systems Manager. For more information, see _Required IAM permissions_ in [AWSConfigRemediation-DeleteUnusedEBSVolume](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-delete-ebs-volume.html). @@ -39,13 +38,0 @@ AWS Config can help you manually or automatically remediate noncompliant resourc -**Technology stack** - - * AWS Config - - * Amazon EBS - - * Systems Manager - - * Systems Manager Automation - - - - @@ -56 +43 @@ AWS Config can help you manually or automatically remediate noncompliant resourc - 1. The AWS Config rule evaluates the EBS volumes. + 1. The AWS Config rule evaluates the Amazon EBS volumes. @@ -58 +45 @@ AWS Config can help you manually or automatically remediate noncompliant resourc - 2. The rule returns a list of compliant and noncompliant resources. EBS volumes that are in the `available` state, which are unused volumes, are determined to be noncompliant. + 2. The rule returns a list of compliant and noncompliant resources. Amazon EBS volumes that are in the `available` state, which are unused volumes, are determined to be noncompliant. @@ -64 +51 @@ AWS Config can help you manually or automatically remediate noncompliant resourc - 5. Systems Manager deletes the unused EBS volumes. + 5. Systems Manager deletes the unused Amazon EBS volumes. @@ -102 +89 @@ Add the automatic remediation action.| - 1. On the Rules page, select the `ec2-volume-inuse-check` rule. + 1. On the **Rules** page, select the `ec2-volume-inuse-check` rule. @@ -105 +92 @@ Add the automatic remediation action.| - * Select **Resource ID parameter** , and then in the list, choose **VolumeId**. At runtime, this parameter is substituted with the ID of the noncompliant EBS volume. + * Select **Resource ID parameter** , and then in the list, choose **VolumeId**. At runtime, this parameter is substituted with the ID of the noncompliant Amazon EBS volume. @@ -107 +94 @@ Add the automatic remediation action.| - * `CreateSnapshot` – (Optional) If set to `true`, the automation creates a snapshot of the EBS volume before it’s deleted. + * `CreateSnapshot` – (Optional) If set to `true`, the automation creates a snapshot of the Amazon EBS volume before it’s deleted. @@ -113 +100 @@ Test the automatic remediation for the AWS Config rule.| - 1. In the AWS Config Console, on the **Rules** page, select the `ec2-volume-inuse-check` rule. + 1. In the AWS Config console, on the **Rules** page, select the `ec2-volume-inuse-check` rule. @@ -123 +110 @@ Issue| Solution -AWS Config doesn’t accurately reflect the resource state.| Sometimes, AWS Config doesn’t update the state of the resources. Turn the recorder off and then turn it back on again on the AWS Config **Settings** page. The recorder captures the state of the resources. For newly created or deleted resources, it might take some time for the recorder to reflect the current state. For more information about EBS volume states, see [Volume state](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-describing-volumes.html#volume-state) in the Amazon EC2 documentation. +AWS Config doesn’t accurately reflect the resource state.| Sometimes, AWS Config doesn’t update the state of the resources. Turn the recorder off and then turn it back on again on the AWS Config **Settings** page. The recorder captures the state of the resources. For newly created or deleted resources, it might take some time for the recorder to reflect the current state. For more information about Amazon EBS volume states, see [Volume states](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-describing-volumes.html#volume-state) in the Amazon EBS documentation.