📝 AWS EFS File System encryption is not enabled 🟢

• Contextual name: 📝 File System encryption is not enabled 🟢
• ID: /ce/ca/aws/efs/file-system-encryption
• Located in: 📁 AWS EFS

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • EFS Encryption Enabled
• Internal
  • dec-x-966d3183

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-966d3183	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS EFS File System
  • 🔌 AWS EFS File System - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

EFS data should be encrypted at rest using AWS KMS (Key Management Service).

Rationale

Data should be encrypted at rest to reduce the risk of a data breach via direct access to the storage device.

Audit

From Console

1. Login to the AWS Management Console and Navigate to Elastic File System (EFS) dashboard.
2. Select File Systems from the left navigation panel.
3. Each item on the list has a visible Encrypted field that displays data at rest encryption status.
4. Validate that this field reads Encrypted for all EFS file systems in all AWS regions.

From Command Line

1. Run describe-file-systems command using custom query filters to list the identifiers of all AWS EFS file systems currently available within the selected region:

aws efs describe-file-systems --region <region> --output table --query 'FileSystems[*].FileSystemId'

2. The command output should return a table with the requested file system IDs.
3. Run describe-file-systems command using the ID of the file system that you want to examine as identifier and the necessary query filters:

... see more

Remediation

Open File

Remediation

It is important to note that EFS file system data at rest encryption must be turned on when creating the file system. If an EFS file system has been created without data at rest encryption enabled then you must create another EFS file system with the correct configuration and transfer the data.

Steps to create an EFS file system with data encrypted at rest:

From Console

1. Login to the AWS Management Console and Navigate to Elastic File System (EFS) dashboard.

2. Select File Systems from the left navigation panel.

3. Click Create File System button from the dashboard top menu to start the file system setup process.

4. On the Configure file system access configuration page, perform the following actions.

• Choose the right VPC from the VPC dropdown list.

• Within Create mount targets section, select the checkboxes for all of the Availability Zones (AZs) within the selected VPC. These will be your mount targets.

• Click Next step to continue.

5. Perform the following on the Configure optional settings page.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 52c appropriate encryption, cleansing and auditing of devices;		9	9
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).		17	18
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS		1	1
💼 CIS AWS v1.5.0 → 💼 2.4.1 Ensure that encryption is enabled for EFS file systems - Level 1 (Manual)			1
💼 CIS AWS v2.0.0 → 💼 2.4.1 Ensure that encryption is enabled for EFS file systems - Level 1 (Manual)			1
💼 CIS AWS v3.0.0 → 💼 2.4.1 Ensure that encryption is enabled for EFS file systems - Level 1 (Automated)		1	1
💼 CIS AWS v4.0.0 → 💼 2.3.1 Ensure that encryption is enabled for EFS file systems (Automated)			1
💼 CIS AWS v4.0.1 → 💼 2.3.1 Ensure that encryption is enabled for EFS file systems (Automated)			1
💼 CIS AWS v5.0.0 → 💼 2.3.1 Ensure that encryption is enabled for EFS file systems (Automated)			1
💼 Cloudaware Framework → 💼 Data Encryption			31
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)		20	21
💼 FedRAMP High Security Controls → 💼 CM-3(6) Cryptography Management (H)			4
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)			4
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)		13	16
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1	7	17
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)		5	12
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			16
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		17
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			16
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		17
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 ISO/IEC 27001:2013 → 💼 A.10.1.1 Policy on the use of cryptographic controls		14	15
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected		15	19
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		43	51
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			67
💼 NIST SP 800-53 Revision 4 → 💼 SC-28 PROTECTION OF INFORMATION AT REST	2	3	3
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		25	27
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks			15
💼 NIST SP 800-53 Revision 5 → 💼 CM-3(6) Configuration Change Control _ Cryptography Management			4
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration			4
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection	4		6
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest	3	15	18
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection		10	12
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection			6
💼 PCI DSS v3.2.1 → 💼 3.4.1 If disk encryption is used, logical access must be managed separately and independently of native operating system authentication and access control mechanisms.		7	7
💼 PCI DSS v4.0.1 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			7
💼 PCI DSS v4.0 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			7