DEV Community

Cover image for Ransomware-Resilient Disaster Recovery ⚡♻
Daffa Rabbani
Daffa Rabbani

Posted on

Ransomware-Resilient Disaster Recovery ⚡♻

#aws #security #ransomeware #cloud

🔴 The Incident That Shook a Nation

On June 20, 2024, the Indonesian government faced its worst digital nightmare in history.

Brain Cipher ransomware — a new variant of LockBit 3.0 — successfully encrypted the entire infrastructure of the Temporary National Data Center (PDNS), operated by the Ministry of Communication and Information Technology.

The result?

❌ 230+ government services PARALYZED
❌ Airports forced to rely on MANUAL processes
❌ Ransom demand: USD 8,000,000
❌ Data that had a backup: < 2%
❌ Recovery time: WEEKS
Enter fullscreen mode Exit fullscreen mode

And the root cause wasn't sophisticated malware — it was having no backup at all.

"The most sophisticated ransomware in the world is powerless against a well-tested backup."

This article rebuilds that scenario as a resilient reference architecture on AWS — complete with code, runbooks, and cost calculations.

🏗️ The Architecture We'll Build

📋 AWS Services Used

Service Role
AWS Backup Centralized backup orchestration, cross-region copy
S3 Object Lock (WORM) Immutable backups that can't be deleted or modified
S3 Vault Lock Policy-level immutability for the AWS Backup vault
AWS Elastic DRS Continuous replication, failover in under 1 hour
Amazon GuardDuty ML-based, real-time threat detection
AWS Security Hub Finding aggregation, compliance scoring
AWS KMS End-to-end encryption for all backup data
AWS CloudTrail 100% API action audit log, forensic-ready
AWS Config Compliance rules, drift detection
EventBridge + Lambda Automated response & isolation

⚙️ Step-by-Step Implementation

Step AWS Module / Service Target Region Core Objective & Key Deliverable
STEP 1 AWS KMS (Customer Managed Keys) Jakarta & Singapore End-to-end symmetric encryption with annual key rotation in both regions
STEP 2 Amazon S3 Object Lock (WORM Bucket) Jakarta (ap-southeast-3) Immutable storage bucket (Compliance Mode 30 days + Glacier Lifecycle)
STEP 3 AWS Backup Vault & Vault Lock Jakarta & Singapore Anti-tamper/anti-deletion backup vaults (Compliance Mode) across regions
STEP 4 AWS Backup Plan & Resource Assignment Jakarta → Singapore Automated backup policies (Hourly, Daily, Monthly) & cross-region copy
STEP 5 Amazon GuardDuty & SNS Alerting Jakarta (ap-southeast-3) Real-time threat detection & instant email notification (Severity ≥ 7)
STEP 6 AWS Security Hub & Insights Jakarta (ap-southeast-3) Centralized compliance dashboard (CIS & FSBP) + Ransomware Risk Insight
STEP 7 AWS CloudTrail (Multi-Region) Multi-Region (ap-southeast-3 & ap-southeast-1) Immutable audit trail (Read/Write Management + S3/Lambda Data Events)
STEP 8 AWS Elastic Disaster Recovery (DRS) Jakarta → Singapore Block-level continuous disk replication (RPO < 1 min, RTO < 1 hr)
  • Primary Region: ap-southeast-3 (Asia Pacific – Jakarta)
  • Recovery Region: ap-southeast-1 (Asia Pacific – Singapore)

STEP 1 — Create KMS Encryption Keys

1A. KMS Key for Jakarta Region (Primary)

  1. Open AWS Management Console → confirm the region in the top-right corner: Asia Pacific (Jakarta) ap-southeast-3.
  2. In the top search bar, type KMS → click Key Management Service.
  3. Click the Create key button (orange).
  4. Fill in the key configuration:
Parameter Value Description & Purpose
Key type Symmetric Industry-standard AES-256 encryption
Key usage Encrypt and decrypt Used for automated backup and recovery operations
Regionality Single-Region key Isolated key dedicated to Jakarta region
  1. Click Next.
  2. Set Alias: pdns-backup-key.
  3. Set Description: PDNS Backup Encryption Key - Jakarta Primary.
  4. Click Next → Next (leave Key Administrators & Key Permissions default) → click Finish.
  5. Record the Key ARN that appears in the reference table below. Example: arn:aws:kms:ap-southeast-3:123456789012:key/xxxx-xxxx-xxxx-xxxx

1B. Enable Key Rotation

  1. On the detail page of the newly created pdns-backup-key, click the Key rotation tab.
  2. Check the box: Automatically rotate this KMS key every year.
  3. Click Save.

1C. KMS Key for Singapore Region (Recovery)

  1. Switch region on the top-right dropdown → select Asia Pacific (Singapore) ap-southeast-1.
  2. Repeat steps 1A and 1B with these settings:
    • Alias: pdns-recovery-key
    • Description: PDNS Recovery Encryption Key - Singapore Recovery
    • Key rotation: Automatically enabled (Enabled)
  3. Record the Key ARN for Singapore region.

KMS Key Reference Table

Record your generated Key ARNs in the following reference table:

Key Alias Target Region Primary Purpose Key ARN (Copy from Console)
alias/pdns-backup-key ap-southeast-3 (Jakarta) Encrypts S3 WORM, Primary Backup Vault, CloudTrail arn:aws:kms:ap-southeast-3:[ACCOUNT-ID]:key/...
alias/pdns-recovery-key ap-southeast-1 (Singapore) Encrypts Singapore Recovery Vault, DRS Staging Volumes arn:aws:kms:ap-southeast-1:[ACCOUNT-ID]:key/...

STEP 2 — Create S3 Bucket with Object Lock (WORM)

⚠️ IMPORTANT: S3 Object Lock can only be enabled when a bucket is first created. It cannot be added after the bucket exists.

2A. Create Bucket in Jakarta

  1. Confirm active region: ap-southeast-3 (Jakarta).
  2. Search for S3 in the top search bar → click S3.
  3. Click the Create bucket button.
  4. Fill in the bucket configuration:
Parameter Value Security Rationale
Bucket name pdns-immutable-backup-[your-account-number] Must be globally unique across AWS
AWS Region Asia Pacific (Jakarta) ap-southeast-3 Primary production region
Object Ownership ACLs disabled (recommended) Access controlled exclusively via IAM policies
Block Public Access Block all public access (All checkboxes checked) Completely prevents unauthorized public exposure
Bucket Versioning Enable Mandatory technical prerequisite for Object Lock
Default Encryption SSE-KMS Server-side encryption with Customer Managed Key (CMK)
KMS Key Select pdns-backup-key Uses Jakarta CMK created in Step 1
Bucket Key Enable Reduces KMS API call costs by up to 99%
Object Lock Enable ✅ Enables WORM (Write Once, Read Many) capability
  1. Under Advanced settings → Object Lock, check Enable and acknowledge the confirmation dialog.
  2. Click Create bucket.

2B. Configure Default Retention (Compliance Mode)

  1. Click the name of the newly created bucket (pdns-immutable-backup-...).
  2. Go to the Properties tab.
  3. Scroll down to Object Lock → click Edit.
  4. Fill in the default retention settings:
Parameter Value Security Impact
Default retention Enable Automatically applied to all newly stored objects
Default retention mode Compliance ⚠️ Absolute protection — objects cannot be deleted by anyone, including Root and AWS Support
Retention period 30 Days Minimum 30-day immutability window for ransomware defense
  1. Click Save changes.

🔴 Critical Note: In Compliance Mode, no user (not even the root account or AWS Support) can delete objects or overwrite them until the 30-day retention period has expired.

2C. Add Lifecycle Rule (Auto-transition to Glacier)

  1. In the same bucket, click the Management tab.
  2. Click the Create lifecycle rule button.
  3. Fill in the lifecycle configuration:
Parameter Value Optimization Purpose
Lifecycle rule name move-to-glacier-after-90-days Policy identifier
Filter scope Apply to all objects in the bucket Covers all historical backup archives
Lifecycle rule actions Check: Transition current versions of objects between storage classes Moves older objects to colder tiers
Storage class transition Glacier Flexible Retrieval Low-cost cold archival storage
Days after object creation 90 Automatic migration after 90 days
  1. Acknowledge the cost transition dialog if prompted → click Create rule.

STEP 3 — AWS Backup Vault + Vault Lock

3A. Create Backup Vault in Jakarta

  1. Confirm active region: ap-southeast-3 (Jakarta).
  2. Search for AWS Backup in the search bar → click AWS Backup.
  3. In the left navigation menu, click Backup vaults.
  4. Click Create backup vault.
  5. Fill in the configuration:
Parameter Value Description
Backup vault name pdns-immutable-vault Primary backup vault in Jakarta
Encryption key Select pdns-backup-key Uses Jakarta KMS key from Step 1
Tags Key: Environment, Value: Production Environment metadata classification
  1. Click Create backup vault.

3B. Enable Vault Lock

⚠️ There is a 72-hour grace period. During the first 3 days, Vault Lock can still be modified or deleted. After that period, it becomes PERMANENT and cannot be deleted or bypassed by anyone, including AWS.

  1. On the pdns-immutable-vault page, click the Vault Lock tab.
  2. Click Configure Vault Lock.
  3. Fill in the parameters:
Parameter Value Security Boundary
Vault Lock mode Compliance Permanent compliance mode (WORM Vault)
Min retention period 7 Days Snapshots cannot be deleted before 7 days
Max retention period 365 Days Upper bound for snapshot retention in the vault
Grace period 72 Hours (Default) Evaluation period before the lock becomes irreversible
  1. Type confirm in the confirmation dialog.
  2. Click Apply Vault Lock.

3C. Create Recovery Vault in Singapore

  1. Switch region to ap-southeast-1 (Singapore).
  2. Navigate to AWS Backup → Backup vaults → Create backup vault.
  3. Fill in the recovery vault settings:
Parameter Value Description
Target Region Asia Pacific (Singapore) ap-southeast-1 Isolated disaster recovery region (Air-gapped)
Backup vault name pdns-recovery-vault Destination vault for cross-region copies
Encryption key Select pdns-recovery-key Independently encrypted with Singapore CMK
Vault Lock mode Compliance (Min 7 days, Max 365 days) Anti-ransomware protection in recovery region
  1. Click Create backup vault.
  2. Repeat step 3B (Vault Lock) on this Singapore vault using the same parameters (Compliance Mode, Min 7 days, Max 365 days).

STEP 4 — Backup Plan (Automated Backup Schedule)

4A. Create IAM Role for Backup

  1. Search for IAM in the search bar → click IAM.
  2. In the left menu, click Roles → click Create role.
  3. Select Trusted entity type: AWS service.
  4. Under Use case, scroll down → select Backup → click Next.
  5. In the Add permissions section, search and check both policies:
    • ✅ AWSBackupServiceRolePolicyForBackup
    • ✅ AWSBackupServiceRolePolicyForRestores
  6. Click Next.
  7. Enter Role name: AWSBackupServiceRole-PDNS.
  8. Click Create role.

4B. Create Backup Plan

  1. Switch region back to ap-southeast-3 (Jakarta).
  2. In AWS Backup → left menu → Backup plans → click Create backup plan.
  3. Select Build a new plan.
  4. Enter Backup plan name: PDNS-Ransomware-Resilient-Plan.

4C. Add Rule 1: Hourly Backup (Critical Services)

  1. Click the Add backup rule button.
  2. Configure the hourly backup rule:
Parameter Value Purpose
Rule name Hourly-Critical-Services High-frequency protection for critical workloads
Backup vault pdns-immutable-vault Local immutable vault in Jakarta
Backup frequency Hourly (Every 1 hour) Ensures ultra-low RPO (< 1 hour)
Backup window Start within 1 hour Execution tolerance window
Transition to cold storage Never Retained in warm storage for rapid restores
Retention period 7 Days Local retention duration
  1. Under Copy to destination:
    • Click Add copy
    • Destination region: Asia Pacific (Singapore)
    • Destination vault: pdns-recovery-vault
    • Retention period: 30 Days
  2. Click Save rule.

4D. Add Rule 2: Daily Backup

  1. Click Add backup rule again.
  2. Configure the daily backup rule:
Parameter Value Purpose
Rule name Daily-All-Resources Routine daily protection for all resources
Backup vault pdns-immutable-vault Primary Jakarta vault
Backup frequency Daily Executed once per day
Backup window 01:00 UTC Off-peak execution window
Transition to cold storage After 90 days Automated migration to cold storage
Retention period 1 Year (365 days) Annual compliance retention
  1. Click Save rule.

4E. Add Rule 3: Monthly Long-Term

  1. Click Add backup rule again.
  2. Configure the monthly long-term backup rule:
Parameter Value Purpose
Rule name Monthly-Long-Term Long-term regulatory compliance archive
Backup vault pdns-immutable-vault Primary Jakarta vault
Backup frequency Monthly First day of every month
Transition to cold storage After 30 days Rapid transition to cold storage for cost efficiency
Retention period 7 Years Meets statutory compliance & audit retention rules
  1. Click Save rule → click Create plan.

4F. Assign Resources to Backup Plan

  1. After the plan is created, click Assign resources.
  2. Fill in the resource assignment form:
Parameter Value Assignment Logic
Resource assignment name All-Production-Resources Resource group assignment identifier
IAM role AWSBackupServiceRole-PDNS Dedicated backup service role from Step 4A
Resource selection Include specific resource types Target workload selection
Resource types Check: EC2, RDS, EFS, DynamoDB, EBS Core compute and database assets
Refine selection using tags Key: Environment, Value: Production All resources with this tag are automatically protected
  1. Click Assign resources.

⚠️ Operational Notice: Ensure all production EC2 instances, RDS databases, and EBS volumes in Jakarta carry the tag: Environment=Production.

STEP 5 — Amazon GuardDuty (Threat Detection)

5A. Enable GuardDuty in Jakarta

  1. Confirm active region: ap-southeast-3 (Jakarta).
  2. Search for GuardDuty in the search bar → click Amazon GuardDuty.
  3. Click the Get Started button.
  4. On the welcome page, click Enable GuardDuty.

5B. Enable Protection Plans

After GuardDuty is active:

  1. In the left menu, click Protection plans.
  2. Enable each protection plan individually by clicking Enable:
Protection Plan Target Status Ransomware Defense Capability
S3 Protection Enabled ✅ Detects suspicious mass reading or unauthorized API activity on S3
Malware Protection for EC2 Enabled ✅ Automatically scans EBS volumes upon detecting suspicious activities
RDS Protection Enabled ✅ Identifies anomalous logins and brute-force patterns on RDS databases
Lambda Protection Enabled ✅ Detects malicious code executions on serverless functions

5C. Configure Finding Frequency

  1. In the left menu, click Settings.
  2. Under Finding export options → Updated finding frequency.
  3. Select: Update CWE every 15 minutes (accelerates finding notifications to EventBridge).
  4. Click Save.

5D. Create SNS Topic for Alerts

  1. Search for SNS in the search bar → click Simple Notification Service.
  2. In the left menu, click Topics → click Create topic.
  3. Configure the topic:
Parameter Value Description
Type Standard Standard publish/subscribe messaging
Name pdns-security-alerts Security alert notification topic
  1. Click Create topic.
  2. On the new topic page, click Create subscription.
  3. Configure the subscription:
Parameter Value Description
Protocol Email Notifications sent via email
Endpoint security@yourdomain.com Target SecOps team email address
  1. Click Create subscription.
  2. Check your inbox → click Confirm subscription on the email received from AWS Notifications.

5E. Create EventBridge Rule: GuardDuty HIGH → Alert

  1. Search for EventBridge in the search bar → click Amazon EventBridge.
  2. In the left menu, click Rules → click Create rule.
  3. Fill in the rule parameters:
Parameter Value Description
Name GuardDuty-High-Severity-Alert EventBridge rule name
Description Alert when GuardDuty detects HIGH/CRITICAL threat Functional description
Event bus default Standard account event bus
Rule type Rule with an event pattern Triggers actions based on incoming event patterns
  1. Click Next.
  2. Under Event pattern → select Custom pattern (JSON editor).
  3. Paste the following JSON pattern: 
{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "severity": [{ "numeric": [">=", 7] }]
  }
}
Enter fullscreen mode Exit fullscreen mode
  1. Click Next.
  2. Under Target 1:
    • Target type: AWS service
    • Select a target: SNS topic
    • Topic: select pdns-security-alerts
  3. Click Next → Next → click Create rule.

✅ Now every GuardDuty finding with severity ≥ 7 will be automatically dispatched to your email within seconds.

STEP 6 — AWS Security Hub

6A. Enable Security Hub

  1. Search for Security Hub in the search bar → click Security Hub.
  2. Click Go to Security Hub / Enable Security Hub.
  3. Ensure the following compliance standards are checked:
    • ✅ AWS Foundational Security Best Practices v1.0.0
    • ✅ CIS AWS Foundations Benchmark v1.4.0
    • ✅ Enable AWS Config (Security Hub requires AWS Config for resource evaluations)
  4. Click Enable Security Hub.

6B. Integrate with GuardDuty

  1. In Security Hub, click Integrations in the left menu.
  2. Type GuardDuty in the search box.
  3. Click Accept findings on the Amazon GuardDuty integration card.
  4. Confirm acceptance.

6C. Setup Ransomware Insight

  1. In the left menu, click Insights → click Create insight.
  2. Configure the custom insight:
Parameter Value Description
Insight name Ransomware-Risk-Indicators Custom security analytical filter
Filter 1 Product name = GuardDuty Focuses on GuardDuty intelligence
Filter 2 Severity label = HIGH, CRITICAL Filters for severe and fatal threats
Filter 3 Workflow status = NEW Displays active unaddressed incidents
Group by Resource ID Aggregates findings per impacted asset
  1. Click Create insight.

STEP 7 — AWS CloudTrail (Audit Log)

7A. Create CloudTrail Trail

  1. Search for CloudTrail in the search bar → open CloudTrail.
  2. In the left menu, click Trails → click Create trail.
  3. Fill in the trail parameters:
Parameter Value Forensic & Security Rationale
Trail name pdns-full-audit-trail Master audit trail name
Storage location Create new S3 bucket Dedicated S3 bucket for audit records
Trail log bucket name pdns-cloudtrail-logs-[account-number] Unique audit bucket name
Log file SSE-KMS encryption Enabled Encrypts all stored log archives
AWS KMS alias Select pdns-backup-key Uses Jakarta CMK
Log file validation Enabled ✅ Generates cryptographic hashes to detect log tampering
CloudWatch Logs Enabled Streams events to CloudWatch for near real-time alerting
Log group name /aws/cloudtrail/pdns-audit Dedicated CloudWatch log group
Multi-region trail Yes ✅ Captures API actions across all AWS regions
  1. Click Next.

7B. Select Events to Log

  1. Under Events:
    • Check: ✅ Management events (Read + Write)
    • Check: ✅ Data events
  2. Under Data events, click Add data event type:
    • Data event type: S3 → All current and future S3 buckets → Read + Write
  3. Click Add data event type again:
    • Data event type: Lambda → All current and future functions
  4. Click Next → review settings → click Create trail.

STEP 8 — AWS Elastic Disaster Recovery (DRS)

8A. Initialize DRS in Recovery Region

  1. Switch region to ap-southeast-1 (Singapore).
  2. Search for Elastic Disaster Recovery in the search bar → click AWS Elastic Disaster Recovery.
  3. Click Set up Elastic Disaster Recovery / Get started.
  4. Configure Default replication settings:
Parameter Value Technical Rationale
Staging area subnet Public Subnet in ap-southeast-1b Subnet where lightweight replication servers run
Security groups pdns-drs-replication-sg Security group governing replication traffic
Instance type t3.small Cost-effective instance for replication servers
EBS encryption Custom → select pdns-recovery-key Ensures encrypted staging storage in DR region
Create public IP Yes Required for cross-region replication traffic over the internet

💡 Architectural Recommendation: Before initializing DRS, create a dedicated VPC in Singapore named pdns-recovery-vpc (10.10.0.0/16) with 1 Public Subnet in AZ ap-southeast-1b and an active Internet Gateway.

  1. Create Security Group pdns-drs-replication-sg in Singapore with:
    • Inbound: Port TCP 1500 from 0.0.0.0/0 (incoming block-level data replication from Jakarta)
    • Outbound: All traffic (Default)
  2. Click Next.

8B. Configure Point-in-Time (PIT) Recovery

  1. Under Point-in-time recovery:
    • Click Add rule
    • Snapshot retention (in days): 7 days
  2. Click Next → click Create.

8C. Install DRS Agent on Production Server

DRS Agent installation is conducted via AWS Systems Manager Session Manager (no SSH port 22 required).

DRS Replication Topology 

[Jakarta - ap-southeast-3]              [Singapore - ap-southeast-1]
┌──────────────────────────┐            ┌──────────────────────────┐
│ PRODUCTION EC2           │            │ DRS Replication Server    │
│ ← Install DRS Agent      │─replicate─►│ (created AUTOMATICALLY    │
│   on this server         │  (Port 1500)│  by AWS DRS, not manually) │
└──────────────────────────┘            └──────────────────────────┘
       SOURCE (Origin)                          TARGET (Recovery)
Enter fullscreen mode Exit fullscreen mode

Step 1 — Create Production EC2 in Jakarta (if not yet exists)

  1. Confirm region: ap-southeast-3 (Jakarta).
  2. Go to EC2 → Instances → Launch instances.
  3. Fill in the instance configuration:
Parameter Value Critical Note
Name pdns-prod-server-01 Production instance identifier
AMI Amazon Linux 2023 SSM Agent pre-installed
Instance type t3.medium ⚠️ Minimum t3.medium — t3.micro (1 GiB RAM) is insufficient for DRS Agent
Storage (EBS) 20 GiB ⚠️ Minimum 20 GiB — 8 GiB is too small for OS + Agent download
Key pair Proceed without key pair Access via Session Manager (no SSH required)
Auto-assign public IP Enable Required for internet connectivity
IAM instance profile EC2-SSM-SessionManager-Role Attach role created in Step 2 below
Tags Key: Environment, Value: Production Required for automated backup by the Backup Plan
  1. Click Launch instance.

Step 2 — Create IAM Role for EC2 (SSM + DRS)

  1. Go to IAM → Roles → Create role.
  2. Select AWS service → Use case: EC2 → click Next.
  3. Check BOTH of the following policies:
    • ✅ AmazonSSMManagedInstanceCore (Session Manager access)
    • ✅ AWSElasticDisasterRecoveryAgentInstallationPolicy (DRS agent installation permissions)
  4. Set role name: EC2-SSM-SessionManager-Role → click Create role.

Step 3 — Attach IAM Role to EC2 Instance

  1. In Jakarta console, open EC2 → Instances.
  2. Check pdns-prod-server-01 → click Actions → Security → Modify IAM role.
  3. Select EC2-SSM-SessionManager-Role → click Update IAM role.

Step 4 — Configure Outbound Security Group (Ports 443 & 1500)

The DRS Agent requires 2 outbound ports from Jakarta to the internet:

Target Port Protocol Purpose
443 HTTPS Communication to DRS Control Plane API
1500 TCP Block-level disk data replication to Singapore
  1. On instance pdns-prod-server-01, go to the Security tab → click the Security Group name.
  2. Open Outbound rules → click Edit outbound rules → click Add rule:
    • Type: Custom TCP
    • Port range: 1500
    • Destination: 0.0.0.0/0
    • Description: DRS Data Replication to Singapore
  3. Click Save rules.

Step 5 — Add KMS Key Permission for DRS

  1. Switch region to ap-southeast-1 (Singapore).
  2. Open KMS → click pdns-recovery-key → Key policy tab → click Edit.
  3. Add the following statement inside the Statement array before the closing ]: 
{
  "Sid": "Allow DRS Service to use this key",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::[YOUR-ACCOUNT-ID]:role/aws-service-role/drs.amazonaws.com/AWSServiceRoleForElasticDisasterRecovery"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey",
    "kms:GenerateDataKeyWithoutPlaintext",
    "kms:DescribeKey",
    "kms:CreateGrant",
    "kms:ReEncrypt*"
  ],
  "Resource": "*"
}
Enter fullscreen mode Exit fullscreen mode

(Replace [YOUR-ACCOUNT-ID] with your 12-digit AWS account ID). Click Save changes.

Step 6 — Verify Instance Readiness in Fleet Manager

  1. Open Systems Manager → Fleet Manager in region ap-southeast-3 (Jakarta).
  2. Wait 3–5 minutes after attaching the IAM role.
  3. Refresh the page until pdns-prod-server-01 appears with status: Online ✅.
Possible Cause Recommended Solution
IAM Role not yet attached Verify and attach EC2-SSM-SessionManager-Role in EC2 Security tab
SSM Agent not running Restart instance from EC2 console
Instance in private subnet without internet Create 3 VPC Interface Endpoints: ssm, ssmmessages, ec2messages

Step 7 — Install DRS Agent via Session Manager

  1. Open Systems Manager → Session Manager in Jakarta.
  2. Click the Start session button in the top-right corner.
  3. On the Specify target page, select pdns-prod-server-01 → click Start session.
  4. In the web terminal that opens, run the following commands one at a time:

Command 1 — Switch to superuser (root):

sudo su -
Enter fullscreen mode Exit fullscreen mode

Command 2 — Install kernel headers & build tools:

sudo dnf install -y kernel-devel kernel-headers gcc make
Enter fullscreen mode Exit fullscreen mode

(Wait until output displays Complete!).

Command 3 — Download official DRS installer:

wget -O /tmp/aws-replication-installer-init.py \
https://aws-elastic-disaster-recovery-ap-southeast-1.s3.amazonaws.com/latest/linux/aws-replication-installer-init.py
Enter fullscreen mode Exit fullscreen mode

Command 4 — Run installer:

sudo python3 /tmp/aws-replication-installer-init.py --region ap-southeast-1 --no-prompt
Enter fullscreen mode Exit fullscreen mode

Wait until execution completes (~10–20 minutes). Installation stages:

Stage Terminal Output Estimated Duration
Volume detection All volumes were successfully identified. ~30 seconds
Agent download Downloading the AWS Replication Agent... Finished. ~3–5 minutes
Agent install Installing the AWS Replication Agent onto the source server... ~5–10 minutes
Complete The AWS Replication Agent was successfully installed. Complete

Command 5 — Enable agent auto-start on reboot:

sudo systemctl enable aws-replication-agent
Enter fullscreen mode Exit fullscreen mode

8D. Verify Replication Status

  1. Switch region to ap-southeast-1 (Singapore).
  2. Open Elastic Disaster Recovery → Source servers.
  3. Inspect the Data replication status column:
Status Indicator Meaning Required Action
Initiating 🟡 Yellow Agent recently connected Wait for handshake
Initial sync 🔵 Blue First synchronization in progress Wait until 100%
Continuous 🟢 Green ✅ Active replication, RPO < 1 minute ✅ Done & protected!
Disconnected 🔴 Red Network or agent connectivity lost Check outbound port 1500 and agent service

8E. Configure Launch Template for Recovery

  1. In DRS left menu, click Launch settings.
  2. Select the source server → click Edit.
  3. Configure the launch template:
Parameter Value Rationale
Launch disposition Stopped Cost optimization; recovered instance started manually during DR
Target subnet Subnet in pdns-recovery-vpc Places recovery VM in isolated network
Security groups Recovery Security Group Governs recovery firewall rules
Instance type Match production (t3.medium) Ensures equivalent compute capacity
  1. Click Save template.

note : If you've achieved 100% replication or the status is green, you can proceed to 8E. In my case, it didn't reach the green status because my internet connection is slow.

💰 Estimated Monthly Architecture Cost

AWS Service Assumed Capacity & Workload Estimated Cost / Month Business Value & Protection
AWS Backup 1 TB Backup storage in Jakarta + cross-region copy to Singapore ~$80 Protects database snapshots & EBS volumes
S3 Object Lock (WORM) 5 TB Immutable data storage (Standard + Glacier) ~$115 Data archives cannot be deleted or modified by attackers
AWS Elastic DRS 5 Production servers continuously replicated to Singapore ~$150 Block-level disk replication with RTO < 1 hour
Amazon GuardDuty VPC Flow, CloudTrail, DNS, S3, & EKS log analysis ~$90 Early threat detection before encryption spreads
AWS Security Hub Centralized security findings aggregation & compliance scoring ~$50 Unified security posture visibility
AWS CloudTrail Free management events + S3/Lambda Data Events ~$40 Tamper-proof digital forensic audit evidence
AWS KMS 2 Customer Managed Keys (Jakarta & Singapore) + API calls ~$20 Independent cryptographic key isolation per region
TOTAL ESTIMATED COST Complete Ransomware-Resilient DR Architecture ~$545 / Month Insurance against tens of millions of dollars in losses

💡 Cost vs. Impact: In the June 2024 PDNS ransomware incident, attackers demanded an $8,000,000 ransom while disrupting 230+ public agencies for weeks. The prevention and resilience architecture documented here costs only ~$545/month.

💰 Cost vs. Benefit

Item Value
Brain Cipher ransom demand USD 8,000,000
Estimated cost of 2 weeks of downtime USD 50,000,000+
Public trust and reputation Priceless
Cost of this architecture/month ~USD 720
ROI 11,000x+

🔗 Resources

Top comments (0)