Profile Applicability:
Level 1
Description:
Amazon Elastic File System (EFS) supports resource-based policies that control access to the file system. EFS policies can grant permissions to specific AWS principals or allow broader access within a Virtual Private Cloud (VPC). It is critical to ensure that EFS policies do not allow unrestricted access to any client within the VPC, as this could lead to unauthorized access and potential data breaches.
Rationale:
Overly permissive EFS file system policies that allow any client within a VPC to access the file system increase the risk of unauthorized access. Misconfigured policies can expose sensitive data to unintended users or services within the network. Implementing least privilege principles ensures that only authorized instances and users can access the file system.
Impact:
Pros:
Reduces risk of unauthorized access to file systems.
Enforces least privilege access control within the VPC.
Enhances overall security posture.
Cons:
May restrict access to legitimate clients if policies are too restrictive.
Requires careful configuration to avoid disrupting legitimate services.
Default Value:
By default, Amazon EFS does not have any resource-based policies applied. Access is controlled via VPC security groups and NFS permissions.
Pre-Requisite:
AWS IAM permissions:
elasticfilesystem:DescribeFileSystems
elasticfilesystem:DescribeFileSystemPolicy
elasticfilesystem:PutFileSystemPolicy
AWS CLI installed and configured.
Remediation:
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to Amazon Elastic File System (EFS).
In the navigation pane, choose File Systems.
Select a file system to review.
Go to the File System Policy tab.
Review the JSON policy:
Check for Effect: Allow statements with Principal: "*" or conditions that grant unrestricted access within the VPC.
Repeat for all EFS file systems in the region.
Using AWS CLI:
Run the following command to list EFS file systems:
aws efs describe-file-systems --region <region> --query 'FileSystems[*].FileSystemId' --output table
For each file system, run the following to retrieve its policy:
aws efs describe-file-system-policy --file-system-id <file-system-id> --region <region>
Inspect the policy output for overly permissive statements, such as:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "elasticfilesystem:ClientMount",
"Condition": {
"StringEquals": {
"aws:Vpc": "vpc-abc12345"
}
}
}
]
}Principal: "*" combined with aws:Vpc conditions may allow any client within the VPC to mount the EFS.
Implementation Steps:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to Amazon Elastic File System (EFS).
Select the file system to modify.
Go to the File System Policy tab.
Click Edit Policy.
Modify the policy to restrict access to specific IAM roles or EC2 instances:
Replace Principal: "*" with specific IAM ARNs.
Use conditions to enforce stricter access controls (e.g., source VPC, subnet, or security groups).
Save the updated policy.
Using AWS CLI:
Prepare a secure EFS file system policy JSON file (efs-policy.json). Example policy allowing only specific roles:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/EFSReadOnlyRole"
},
"Action": "elasticfilesystem:ClientMount",
"Condition": {
"StringEquals": {
"aws:Vpc": "vpc-abc12345"
}
}
}
]
}Apply the new policy to the EFS file system:
aws efs put-file-system-policy --file-system-id <file-system-id> --policy file://efs-policy.json --region <region>
Verify the policy update:
aws efs describe-file-system-policy --file-system-id <file-system-id> --region <region>
Backout Plan:
If the updated policy causes disruptions or unintended access issues:
Revert to the previous EFS policy by restoring the last known good policy JSON.
Use the AWS Console or CLI to reapply the previous policy:
aws efs put-file-system-policy --file-system-id <file-system-id> --policy file://previous-policy.json --region <region>
Monitor application and client access to ensure proper functionality is restored.