Skip to main content

🛡️ AWS EFS File System is not encrypted with KMS CMK🟢

Logic​

Similar Policies​

Description​

Open File

Here’s a more polished and professional version of your text, with improved clarity, consistency, and tone while preserving the original meaning:

Description​

This policy identifies AWS EFS file systems that are encrypted using AWS-managed keys (the default keys applied by the EFS service when no customer-managed keys are specified) rather than AWS KMS customer-managed keys (CMKs). Using CMKs provides greater control over encryption key management, access policies, and auditing capabilities compared to AWS-managed keys.

Rationale​

Encrypting data at rest adds an important layer of security by protecting stored data from unauthorized access to the underlying storage. Although AWS provides a default managed key (aws/elasticfilesystem) for EFS encryption, using a customer-managed keys offers several additional security and governance benefits:

  1. Enhanced Control: Full ownership of the key lifecycle, including creation, rotation, and permission management.
  2. Improved Auditing: Detailed key usage visibility through AWS CloudTrail, enabling precise tracking of when and how encryption keys are used.

... see more

Remediation​

Open File

Remediation​

Encrypt EFS File System Using KMS CMK​

Encryption at rest for Amazon EFS can only be enabled during the creation of the file system. It is not possible to enable encryption or change the KMS key for an existing file system.

From Command Line​

  1. Create a customer-managed KMS key:

    aws kms create-key \
        --region {{us-east-1}} \
        --description "CMK for EFS data encryption"

  2. (Optional) Create an alias for the CMK:

    aws kms create-alias \
        --region {{us-east-1}} \
        --alias-name {{alias/efs-cmk}} \
        --target-key-id {{cmk-arn}}

  3. Create a new EFS file system using the CMK:

    aws efs create-file-system \
        --region {{us-east-1}} \
        --creation-token {{unique-token}} \
        --encrypted \
        --kms-key-id {{cmk-arn}}

  4. Create mount targets for the new file system (repeat for each AZ):

    aws efs create-mount-target \
        --region {{us-east-1}} \
        --file-system-id {{new-file-system-id}} \

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS12no data
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest19no data
💼 Cloudaware Framework → 💼 Data Encryption66no data
💼 FedRAMP High Security Controls → 💼 CM-3(6) Cryptography Management (H)16no data
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)16no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1640no data
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)1735no data
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)524no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)135no data
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)24no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)135no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)24no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected173no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected149no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected169no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks39no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3(6) Configuration Change Control _ Cryptography Management16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection429no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest31736no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection1024no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection25no data