Back to Checks
aws

Region has AWS Elastic Disaster Recovery (DRS) enabled with at least one recovery job

drs_job_exist
Service: drsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

AWS Elastic Disaster Recovery is assessed per Region to verify the service is initialized and that at least one recovery or drill job exists, demonstrating that failover has been exercised.

Prowler logoProwlerprowler-provider-aws

Risk

Without DRS enabled or any prior jobs, workloads are unprotected and untested, undermining availability. During outages or ransomware, recovery may be delayed or fail, increasing RTO/RPO, causing data loss and prolonged downtime.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks drs_job_exist

Recommendation

Enable DRS in required Regions and protect critical workloads. Define RTO/RPO and run regular recovery drills to validate launch settings and dependencies. Apply least privilege, monitor replication health, and document failover procedures to ensure consistent, repeatable recovery.

Remediation

Other

1In the AWS Console, switch to the target Region
2Open Elastic Disaster Recovery (DRS)
3Click "Set default replication settings" (or Settings > Initialize) and choose "Configure and initialize" to enable DRS in this Region
4Go to "Source servers" > "Add server", copy the install command, run it on one server, and wait until it shows Data replication status = Healthy and Ready for recovery
5Select that server, choose "Initiate recovery drill" (or "Initiate recovery") and confirm to create a job
6Verify under "Recovery job history" that the job completes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.drs.drs_client import drs_client


class drs_job_exist(Check):
    def execute(self):
        findings = []
        for drs in drs_client.drs_services:
            report = Check_Report_AWS(metadata=self.metadata(), resource=drs)
            report.resource_arn = drs_client._get_recovery_job_arn_template(drs.region)
            report.resource_id = drs_client.audited_account
            report.status = "FAIL"
            report.status_extended = "DRS is not enabled for this region."

            if drs.status == "ENABLED":
                report.status_extended = "DRS is enabled for this region without jobs."
                if drs.jobs:
                    report.status = "PASS"
                    report.status_extended = "DRS is enabled for this region with jobs."

            if report.status == "FAIL" and (
                drs_client.audit_config.get("mute_non_default_regions", False)
                and not drs.region == drs_client.region
            ):
                report.muted = True

            findings.append(report)

        return findings

References