# 2.3.1 Ensure Encryption is Enabled for EFS File Systems (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233132-2-3-1-ensure-encryption-is-enabled-for-efs-file-systems-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 2](https://support.icompaas.com/support/solutions/folders/62000169193) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1** **Description:** Amazon Elastic File System (EFS) should be encrypted at rest using AWS Key Management Service (KMS) to protect stored data. Why Encrypt EFS? - Prevents unauthorized access to stored files. - Mitigates risks from direct access to the storage device. - Meets security compliance standards (CIS, PCI-DSS, HIPAA, GDPR). ## Rationale: Protects sensitive data by encrypting at rest. Encrypts automated backups & snapshots stored in AWS. Reduces risk of data leaks if unauthorized access is attempted. Required for compliance audits (SOC 2, ISO 27001, CIS Benchmark). ## Impact: Data security is enhanced. Prevents unauthorized file access. Seamless integration with AWS KMS. ## Default Value: Encryption is NOT enabled by default for EFS when using AWS CLI, API, or SDKs. Encryption IS enabled by default when creating an EFS file system via AWS Console. ## Pre-Requisites: IAM permissions required: - elasticfilesystem:DescribeFileSystems - elasticfilesystem:CreateFileSystem - elasticfilesystem:DeleteFileSystem - kms:ListKeys AWS CLI installed for automation. ## Remediation: ## Test Plan: ## Using AWS Console Step 1: Check EFS Encryption Status 1. Log in to the AWS Management Console 2. Navigate to Amazon EFS Console → [](https://console.aws.amazon.com/efs/)[EFS Dashboard](https://console.aws.amazon.com/efs/)       ![](https://support.icompaas.com/assets/kb/5a79094b607837f3.png) 3. Click File Systems in the left panel.              ![](https://support.icompaas.com/assets/kb/f427bc7580bf6459.png) 4. Check the Encryption column: - If Enabled → EFS is encrypted - If Disabled → EFS is not encrypted and must be remediated **Audit Steps Using AWS CLI** **Step 1: List All EFS File Systems in a Region** aws efs describe-file-systems --region --query 'FileSystems\[\*\].FileSystemId' **This command returns a list of all EFS file system IDs.** **Step 2: Check Encryption Status for Each EFS** aws efs describe-file-systems --region --file-system-id --query 'FileSystems\[\*\].Encrypted' **Expected Output (If Encrypted):** \[ true \] **Implementation steps:** ## Using AWS Console Encryption must be enabled during EFS creation. If an EFS is unencrypted, migrate data to a new encrypted EFS. Method 1: Create an Encrypted EFS via AWS Console Step 1: Create a New Encrypted EFS 1. Log in to the AWS Console 2. Navigate to Amazon EFS Console        ![](https://support.icompaas.com/assets/kb/e485ec8a9a9bdbb4.png) 3. Click Create File System   **![](https://support.icompaas.com/assets/kb/0b0ea98ec066bcd1.png)** 4. Choose a VPC & Availability Zones    **![](https://support.icompaas.com/assets/kb/c35e830082400796.png)** 5. Under Encryption, select Enable Encryption      **![](https://support.icompaas.com/assets/kb/893ccaefcd92c5e8.png)** 6. **Choose** AWS KMS Key (aws/elasticfilesystem)    **![](https://support.icompaas.com/assets/kb/82c8e62e797ee0c1.png)** 7. Click Next → Create File System        **![](https://support.icompaas.com/assets/kb/f464c370eb976fb6.png)** **Step 2: Migrate Data from Old Unencrypted EFS** 1. **Mount the old EFS on an EC2 instance.** 2. **Mount the new encrypted EFS.****Copy data using the rsync command:** rsync -avz /old-efs-mount /new-encrypted-efs-mount 3. **Unmount the old EFS.** 4. **Delete the old unencrypted EFS.** **Method 2: Create an Encrypted EFS via AWS CLI** **Step 1: Create a New Encrypted EFS** aws efs create-file-system --region --performance-mode generalPurpose --encrypted **This creates a new encrypted EFS using AWS KMS.** **Step 2: Create Mount Targets for the Encrypted EFS** aws efs create-mount-target --region --file-system-id --subnet-id **Creates mount targets for accessing the encrypted EFS.** **Step 3: Migrate Data from Old EFS to New Encrypted EFS** 1. **Mount old & new EFS on an EC2 instance.** rsync -avz /mnt/old-efs /mnt/new-encrypted-efs 2. **Unmount the old EFS.** **Delete the old unencrypted EFS:** aws efs delete-file-system --region --file-system-id **Backout Plan:** **If enabling encryption causes issues:** 1. **Revert back to the old unencrypted EFS.** 2. **Unmount the new encrypted EFS.** 3. **Modify application configurations to use the old EFS.** 4. **Monitor system logs for performance impact.** ## **References:** - **[](https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html)**[](https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html)[Amazon EFS Encryption Best Practices](https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html) - [AWS CLI Reference for EFS](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/efs/index.html#efs)[](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/efs/index.html#efs)**[](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/efs/index.html#efs)** ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.