Skip to main content

How to Find AWS EFS without Encryption At Rest

Problem​

EFS should be encrypted at rest to prevent exposure of sensitive data to bad actors.

info

This security check is part of the CIS Amazon Web Services Benchmarks and is rated severity medium.

Prerequisites​

This guide assumes that you have already installed and configured Resoto to collect your AWS cloud resources.

Directions​

  1. Execute the following search command in Resoto Shell or Resoto UI:

    > search is(aws_efs_file_system) and volume_encrypted==false
    ​kind=aws_efs_file_system, ..., region=resoto-poweruser
    ​kind=aws_efs_file_system, ..., account=poweruser-team

  2. Pipe the search command into the dump command:

    > search is(aws_efs_file_system) and volume_encrypted==false | dump
    ​reported:
    ​  id: /aws/efs/123
    ​  name: some-name
    ​  ctime: '2022-12-05T22:53:14Z'
    ​  kind: aws_efs_file_system
    ​  age: 2mo28d

    The command output will list the details of all non-compliant aws_efs_file_system resources.

  3. Fix detected issues by following the remediation steps:

    • Enable encryption at rest for EFS file systems.
    • Encryption at rest can only be enabled during the file system creation.
    note

    Please refer to the AWS EFS documentation for details.

Further Reading​