Amazon Elastic File System (Amazon EFS)
  1. CNS Policies
  2. AWS Knowledge Base
  3. Amazon Elastic File System (Amazon EFS)

EFS Encryption Disabled

This plugin makes sure that EFS volumes are encrypted when they're not in use

Risk Level: Medium

Description: 

This plugin makes sure that EFS volumes are encrypted when they're not in use. EFS provides data encryption at rest using AWS Key Management Service keys (KMS).

About the Service :

Amazon EFS is a scalable file storage system that works with Amazon EC2. For workloads and applications operating on several instances, an EFS file system may be used as a shared data source. With no need for maintenance or provisioning, Amazon Elastic File System (Amazon EFS) expands and shrinks as the files are added or deleted.

Impact : 

In case the encryption is disabled there are greater chances of unauthorized access and the compliance requirements will not be met.

Steps to reproduce :

  1. Log in to the AWS Management Console.
  2. Navigate to the Amazon EFS dashboard.
    https://ap-south-1.console.aws.amazon.com/efs/ 
  3. Click on File systems on the left navigation panel.
  4. Click on the file system that you want to examine.
  5. Check whether it shows the encryption is enabled or not.
  6. Repeat the same steps for other file systems as well.

Steps for remediation :

  1. Log in to the AWS Management Console.
  2. Navigate to the Amazon EFS dashboard.
    https://ap-south-1.console.aws.amazon.com/efs/ 
  3. Click on File systems on the left navigation panel.
  4. Click on the file system that you want to examine.
  5. Check whether it shows the encryption is enabled or not.
  6. If the encryption is disabled then click on Create new file system
  7. Fill in all the necessary details required in the File System Settings dialogue box.
  8. In the encryption table, select enable encryption and fill in the KMS key.
  9. Fill in all the details in the Network Access tab.
  10. Click next, and then select the most appropriate options of File System Policy.
  11. Click Next and then click Create.
  12. Take the copy of the data of the old file system in this file system and then delete the old file system.
  13. Repeat the same steps for other file systems as well.

References: