Description

Ensure that Amazon EFS mount targets are not reachable from the public internet, by confirming that mount targets reside in private subnets and that their associated security groups do not allow inbound NFS traffic (port 2049) from 0.0.0.0/0 or ::/0.

Rationale

A mount target reachable from the public internet, combined with an overly permissive security group, could allow an unauthorized party to attempt to mount the file system and access or tamper with its contents, particularly if the file system's access policy or POSIX permissions are also misconfigured. Restricting mount target reachability to trusted private network ranges, and ensuring only specific, intended security groups can reach port 2049, significantly reduces this exposure.

Impact

  • Prevents unauthorized network-level access attempts to the file system from the public internet

  • Reduces the risk of unauthorized mounting or data exposure

  • Requires legitimate clients to connect from within the VPC, a peered VPC, or over a VPN/Direct Connect, rather than directly from the public internet

Default Value

There is no single default; mount target subnet placement and security group configuration are determined at file system and mount target creation time and must be explicitly reviewed.

Pre-Requisites

  • IAM permissions to view and modify EFS mount targets and their associated security groups (elasticfilesystem:DescribeMountTargets, elasticfilesystem:ModifyMountTargetSecurityGroups, ec2:AuthorizeSecurityGroupIngress, ec2:RevokeSecurityGroupIngress)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EFS > File systems and select the file system to review.

  3. Open the Network tab and review each mount target's subnet.

  4. Verify each mount target resides in a private subnet (without a direct route to an internet gateway) unless a documented exception applies.

  5. Review the security group(s) associated with each mount target for inbound rules allowing NFS (port 2049) from 0.0.0.0/0 or ::/0.

  6. If any mount target is in a public subnet or has an overly permissive security group, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EFS > File systems and select the file system to update.

  3. Open the Network tab, select the mount target(s) to update, and edit their associated security groups.

  4. Remove any inbound rule allowing port 2049 from 0.0.0.0/0 or ::/0, and add rules scoped to the specific security group(s) or CIDR range(s) used by legitimate client instances.

  5. If a mount target resides in a public subnet, create a new mount target in an appropriate private subnet, update client mount configuration to use the new mount target's IP/DNS, and delete the old, publicly reachable mount target once traffic has cut over.

  6. Verify legitimate clients can still mount and access the file system, and that access from outside the intended network is now blocked.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon EFS > File systems and select the affected file system.

  3. Open the Network tab and re-add the broader inbound rule (0.0.0.0/0 on port 2049) to the mount target's security group, if reverting is required.

Reference