Description

Ensure that Amazon Elastic File System (EFS) file systems have encryption at rest enabled using an AWS KMS key, so that data stored on the file system is encrypted.

Rationale

Without encryption at rest, data written to an EFS file system is stored unencrypted on the underlying storage, which does not meet common confidentiality requirements for file-based application data, shared configuration, or user-uploaded content. Because encryption at rest can only be enabled when the file system is created, and cannot be changed afterward, it should be verified and enforced as a standard for every new file system.

Impact

  • Protects data stored on the file system at rest

  • Supports compliance requirements mandating encryption of file-based storage

  • Encryption at rest cannot be enabled on an existing, unencrypted file system; migration to a new file system is required to remediate

Default Value

Encryption at rest is enabled by default in the AWS Management Console file system creation wizard, but can be disabled, and is not enforced by default via the CLI/API, so existing file systems should be verified.

Pre-Requisites

  • IAM permissions to view and create EFS file systems (elasticfilesystem:DescribeFileSystems, elasticfilesystem:CreateFileSystem)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EFS > File systems.

  3. Select the file system to review.

  4. Review the Encryption field.

  5. Verify that Encrypted shows as Yes, with the KMS key noted.

  6. If a file system shows Encrypted as No, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EFS > File systems and select Create file system.

  3. Enable Encryption of data at rest and select the desired KMS key (AWS-managed or customer-managed).

  4. Complete file system creation, including mount target configuration in the appropriate subnets.

  5. Migrate data from the unencrypted file system to the new encrypted file system (for example, using AWS DataSync or a manual copy process), and update application mount configuration to reference the new file system.

  6. Once the migration is verified, delete the old, unencrypted file system.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EFS > File systems and select Create file system.

  3. Create a new file system without encryption enabled, if reverting is required, and migrate data back to it.

  4. Update application mount configuration and delete the encrypted file system once the migration is verified.

Reference