help with EC2 back up data, migrate your applications to a new instance, and terminate the old one

0

I have received EC2 abuse email that my instance was compromised. How do I back up the data, migrate your applications to a new instance, and terminate the old one? Thank you

2개 답변
0

Backup & restore your instance using AWS Backup, if you've never used this before then there is a good practice exercise here https://aws.amazon.com/getting-started/hands-on/amazon-ec2-backup-and-restore-using-aws-backup/

As well as AWS backup. consider using snapshots https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/ec2-backup.html

You cannot directly recover your instance from a snapshot, but you can create a new AMI from which a new EC2 system volume can be created, and the additional data volumes can be created from snapshots.

Once you have things back up and running on the new instance, it would be worth considering scheduling regular snapshots (daily or weekly) going forward.

profile picture
전문가
Steve_M
답변함 9달 전
profile pictureAWS
전문가
검토됨 9달 전
0

In addition to the above answer, you'll want to be sure to follow an incident response procedure. Mainly, after ensuring all of your data is backed up, you'll want to isolate and decommission the instance.

The following AWS workshop simulates responding to a compromised EC2 Instance and performing follow-on forensic investigation and analysis of the acquired data, leveraging the Linux command line and AWS CLI tools: https://catalog.us-east-1.prod.workshops.aws/workshops/e524ee28-a1ac-4cc6-b599-d5ced0fc5de1/en-US#overview

I'd suggest using the workshop steps as a guide for conducting incident response in your own environment.

profile pictureAWS
MikeAWS
답변함 9달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠