Check ID: drs_job_exist
Provider: AWS
Service: drs
Severity: MEDIUM
Categories: resilience
Resource type: Other

​
What this check verifies

AWS Elastic Disaster Recovery is assessed per Region to verify the service is initialized and that at least one recovery or drill job exists, demonstrating that failover has been exercised.

​
Risk

Without DRS enabled or any prior jobs, workloads are unprotected and untested, undermining availability. During outages or ransomware, recovery may be delayed or fail, increasing RTO/RPO, causing data loss and prolonged downtime.

​
Recommendation

Enable DRS in required Regions and protect critical workloads. Define RTO/RPO and run regular recovery drills to validate launch settings and dependencies. Apply least privilege, monitor replication health, and document failover procedures to ensure consistent, repeatable recovery.

​
Remediation

Dashboard steps
  1. In the AWS Console, switch to the target Region
  2. Open Elastic Disaster Recovery (DRS)
  3. Click “Set default replication settings” (or Settings > Initialize) and choose “Configure and initialize” to enable DRS in this Region
  4. Go to “Source servers” > “Add server”, copy the install command, run it on one server, and wait until it shows Data replication status = Healthy and Ready for recovery
  5. Select that server, choose “Initiate recovery drill” (or “Initiate recovery”) and confirm to create a job
  6. Verify under “Recovery job history” that the job completes

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = drs_job_exist. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks