# Ensure Amazon EFS Encrypted

- Source: https://support.icompaas.com/support/solutions/articles/62000218561-ensure-amazon-efs-encrypted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Description:

Amazon Elastic File System (Amazon EFS) provides simple, scalable, highly available, and highly durable shared file systems in the cloud. The file systems you create using Amazon EFS are elastic, allowing them to grow and shrink automatically as you add and remove data. They can grow in size to petabytes, distributing data across an unconstrained number of storage servers in multiple Availability Zones (AZs).

  

**Rational:**

Data encrypted at rest is transparently encrypted while being written, and transparently decrypted while being read, so you don’t have to modify your applications. Encryption keys are managed by the AWS Key Management Service (KMS), eliminating the need to build and maintain a secure key management infrastructure.

  

### Impact:

Encrypt your EFS file systems to protect your data and metadata from unauthorized access and fulfill compliance requirements for data-at-rest encryption within your organization.

  

### Default:

By default AWS EFS will encrypt the data.

  

#### Pre-requisites:

1.  Create a File system

  

### Remediation:

  

### Test Plan:

1.  Log in to the AWS Management Console.
    
2.  Navigate to Elastic File System (EFS) dashboard at [https://console.aws.amazon.com/efs/](https://console.aws.amazon.com/efs/ "https://console.aws.amazon.com/efs/").
    
3.  In the left navigation panel, select **File Systems**.![](https://support.icompaas.com/assets/kb/b7683c5934feead7.png)
    
4.  Click on the file system you want to examine, details will be shown up **check the status under encrypted**  
    **![](https://support.icompaas.com/assets/kb/8c9a12513fa2f93e.png)**
    

  

**Using AWS CLI:**

aws efs describe-file-systems \\
    --file-system-id <value>

  

#### Implementation Steps:

**Note:** There is no way to edit the existing File system, we need to create the new File System with encryption enabled, copy data from the old file system to the new file system and delete the old one.

1.  Log in to the AWS Management Console.
    
2.  Navigate to Elastic File System (EFS) dashboard at [https://console.aws.amazon.com/efs/](https://console.aws.amazon.com/efs/ "https://console.aws.amazon.com/efs/").
    
3.  In the left navigation panel, select **File Systems**.![](https://support.icompaas.com/assets/kb/402c4995c3681e9a.png)
    
4.  Click on **create a file system**  
    **![](https://support.icompaas.com/assets/kb/f9011f1ca65a2bdd.png)**
    
5.  **Give the **File system Name, select the VPC and click on Create****  
    **![](https://support.icompaas.com/assets/kb/73d132adb07ebb2c.png)**  
    ****Note: By creating the file system from the above step encryption will be enabled by default with the default master key provided and managed by AWS KMS. This default master key is an AWS-managed key that is created automatically for the EFS service within your AWS account.****  
    ****If you want to cross-check the Encryption follow the below steps****
    
6.  ****Click on** ****Customize****** **![](https://support.icompaas.com/assets/kb/5a9278d23a05132c.png)** 
    
7.  **Make sure Encryption is enabled under the Encryption section**![](https://support.icompaas.com/assets/kb/0841578dc77fecb5.png)
    
8.  Just keep clicking on the Next button by checking all the details and click on Create ![](https://support.icompaas.com/assets/kb/d6cb3c7bbe7fe819.png) 
9.  Copy the data from the source (old) EFS file system onto the new one
10.   Click on Next
11.   In-network Access  mention VPC ![](https://support.icompaas.com/assets/kb/713ac32275b53e89.png) 
12.   Click on Next
13.  Check the check box if you want to provide any access ![](https://support.icompaas.com/assets/kb/31c5dbff1331f10d.png) 
14.  Click on Next 
15.  Click on review and create 
     
     ![](https://support.icompaas.com/assets/kb/74fbd87728e095c0.png)
     

![](https://support.icompaas.com/assets/kb/a2edbaeadf8866fe.png)

**Using AWS CLI:**

**To Create a file** 

aws efs create-file-system
  --region us-east-1
  --creation-token cli-d7164e1d-ada4-4c01-b433-d33b1cada665
  --performance-mode generalPurpose
  --encrypted

  

#### Backout Plan:

You can’t edit the existing File System, so you can not revoke the changes.

  

### References:

[![](https://support.icompaas.com/assets/kb/053a5cd7cc7cfb47.png)Basic Concepts and Terminology - Encrypting File Data with Amazon Elastic File System](https://docs.aws.amazon.com/whitepapers/latest/efs-encrypted-file-systems/basic-concepts-and-terminology.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.