Use the Conformity Knowledge Base AI to help improve your Cloud Posture

EBS Volume Naming Conventions

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Low (generally tolerable level of risk)
Rule ID: EBS-006

Ensure that all your AWS EBS volumes are using proper naming conventions for tagging in order to manage them more efficiently and adhere to AWS resource tagging best practices. A naming convention is a well-defined set of rules useful for choosing the name of an AWS resource. Cloud Conformity strongly recommends using the following pattern (default) for naming your EBS volumes: ^volume-(ue1|uw1|uw2|ew1|ec1|an1|an2|as1|as2|se1)-([1-2]{1})([a-c]{1})-(d|t|s|p)-([a-z0-9\-]+)$. In case you need to create your custom naming pattern, the default one can be easily replaced within the rule settings available on Cloud Conformity console.

This rule can help you with the following compliance standards:

  • APRA
  • MAS

For further details on compliance standards supported by Conformity, see here.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Security

Naming (tagging) your AWS EBS volumes logically and consistently has several advantages such as providing additional information about the volume location and usage, promoting consistency within the selected environment, distinguishing fast similar resources from one another, avoiding naming collisions, improving clarity in cases of potential ambiguity and enhancing the aesthetic and professional appearance.


Default Pattern Format

volume-RegionCode-AvailabilityZoneCode-EnvironmentCode-ApplicationCode

Default Pattern Components

RegionCode
(ue1|uw1|uw2|ew1|ec1|an1|an2|as1|as2|se1) for us-east-1, us-west-1, us-west-2, eu-west-1, eu-central-1, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, sa-east-1.
AvailabilityZoneCode
([1-2]{1})([a-c]{1}) e.g. (2a|2b|2c) for us-west-2a, us-west-2b, us-west-2c
EnvironmentCode
(d|t|s|p) for development, test, staging, production.
ApplicationCode
([a-z0-9\-]+) for applications (e.g. nginx, nodejs) that run on these resources.

Default Pattern Examples

volume-us-east-1-2b-p-nginx
volume-us-west-1-2c-p-apache

Audit

To verify the naming conventions used for tagging your EBS volumes, perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under ELASTIC BLOCK STORE section, choose Volumes.

04 Open the dashboard Show/Hide Columns dialog box by clicking the configuration icon:

Open the dashboard Show/Hide Columns dialog box by clicking the configuration icon

05 Inside the Show/Hide Columns dialog box, under Your Tag Keys column, select the Name checkbox then click Close to return to the EBS dashboard.

06 Under Name column, check the name tag value e.g.

Under Name column, check the name tag value

of each volume provisioned in the current AWS region. If one or more EBS volumes are not using naming conventions based on the Cloud Conformity default pattern (i.e. ^volume-(ue1|uw1|uw2|ew1|ec1|an1|an2|as1|as2|se1)-([1-2]{1})([a-c]{1})-(d|t|s|p)-([a-z0-9\\-]+)$) or based on a well-defined custom pattern, the naming structure of these resources does not adhere to AWS tagging best practices.

07 Change the AWS region from the navigation bar and repeat the audit process for other regions.

Using AWS CLI

01 Run describe-volumes command (OSX/Linux/UNIX) using custom query filters to list the name tags values of the EBS volumes provisioned within the selected AWS region:

aws ec2 describe-volumes
	--region us-east-1
	--output table
	--query 'Volumes[*].Tags'

02 The command output should return an empty table if the available volumes do not have name tags defined or a populated table if the EBS volumes have already name tags defined, as shown in the following example:

-------------------------------------
|          DescribeVolumes          |
+------+----------------------------+
|  Key |           Value            |
+------+----------------------------+
| Name |  WebAppCacheServerVolume   |
| Name |  WebAppAPIServerVolume     |
+------+----------------------------+

If the names returned in the Value table column do not follow any recommended naming conventions, the naming (tagging) structure of the specified EBS volumes does not adhere to AWS tagging best practices.

03 Change the AWS region by updating the --region command parameter value and repeat step no. 1 and 2 to perform the audit process for other regions.

Remediation / Resolution

To implement the appropriate naming convention for tagging your existing EBS volumes based on the default (recommended) pattern (i.e. ^volume-(ue1|uw1|uw2|ew1|ec1|an1|an2|as1|as2|se1)-([1-2]{1})([a-c]{1})-(d|t|s|p)-([a-z0-9\\-]+)$), perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under ELASTIC BLOCK STORE section, choose Volumes.

04 Select the EBS volume that you want to retag.

05 Select Tabs tab from the dashboard bottom panel and click the Add/Edit Tags button to add or change the resource Name tag.

06 In the Add/Edit Tags dialog box, perform the following actions:

  1. If the selected volume does not have a Name tag defined, click Create Tag button and provide the following information:
    • In the Key box type Name as the key name.
    • In the Value box enter a value for the Name tag, value that must be defined based on Cloud Conformity pattern, e.g. volume-us-west-1-2b-p-apache.
  2. If the selected volume does have a Name tag already defined, change the tag value available in the Value box with one that follows the Cloud Conformity default pattern, e.g. volume-us-west-1-2b-p-apache.
  3. Click Save to apply the changes. The selected EBS volume is now tagged using an appropriate naming convention.

07 Repeat steps 4 – 6 to rename (retag) other AWS EBS volumes that require a valid naming convention, available in the current region.

08 Change the AWS region from the navigation bar and repeat the entire process for other regions.

Using AWS CLI

01 Run describe-volumes command (OSX/Linux/UNIX) using custom filters to list the IDs of the EBS volumes tagged without using an appropriate naming convention (see Audit section part II to identify the invalid Name tag values). The following command example expose the ID of an EBS volume tagged with Name=WebAppCacheServerVolume, provisioned in the US East-1 region:

aws ec2 describe-volumes
	--region us-east-1
	--filters "Name=tag:Name,Values=WebAppCacheServerVolume"
	--query 'Volumes[*].VolumeId'

02 The command output should return the ID of the volume identified by the Name tag value:

[
    "vol-9a19753d"
]

03 Run create-tags command (OSX/Linux/UNIX) using the volume ID returned at the previous step as identifier to add or overwrite the Name tag value for the specified AWS EBS volume. The following command example overwrites the Name tag value of a volume with the ID vol-9a19753d, provisioned in the US East-1 region. The tag value used, i.e. volume-us-west-1-2b-p-apache, follows a well-defined naming convention based on the Cloud Conformity recommended pattern (if successful, the command does not return an output):

aws ec2 create-tags
	--region us-east-1
	--resources vol-9a19753d
	--tags Key=Name,Value=volume-us-west-1-2b-p-apache

04 Repeat steps no. 1 - 3 to retag other EBS volumes that require a valid naming convention, available in the current region.

05 Repeat steps no. 1 - 4 to implement the entire process for other AWS regions.

References

Publication date Sep 8, 2016