# Ensure EFS file system has backup enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292240743994-ensure-efs-file-system-has-backup-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon Elastic File System (EFS) file system has automatic backups enabled. When automatic backups are enabled, the file system's backup policy is set to ENABLED and AWS Backup takes daily backups of the file system.

**Rationale**

Without backups, accidental deletion, ransomware or a misconfiguration can corrupt or destroy file system data with no way to recover it, affecting the availability and integrity of the data. Point-in-time backups allow data to be restored and support recovery objectives. Automatic backups should be enabled on every file system, with suitable retention, restricted delete and restore permissions, and regular restore tests.

**Impact**

-   Provides daily backups that can be used to restore lost or corrupted data
    
-   Backup storage is charged by AWS Backup
    
-   Enabling backups does not affect file system performance or clients
    

**Default Value**

When a file system is created in the Amazon EFS console, automatic backups are enabled by default. File systems created by other means may not have automatic backups enabled.

**Pre-Requisites**

-   IAM permissions: elasticfilesystem:DescribeFileSystems, elasticfilesystem:DescribeBackupPolicy and elasticfilesystem:PutBackupPolicy
    
-   Permission for AWS Backup to use its service-linked role, which is created automatically when automatic backups are first enabled
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EFS console and select **File systems**.
    
3.  Select each file system and check the **Automatic backups** setting in the **General** section.
    
4.  Repeat for each region in use.
    
5.  If automatic backups are not enabled for any file system, follow the implementation steps.
    

**CLI:**

List the file systems in a region:

aws efs describe-file-systems --region <REGION> --query "FileSystems\[\].\[FileSystemId,Name\]" --output table

Show the backup policy of a file system:

aws efs describe-backup-policy --file-system-id <FILE\_SYSTEM\_ID> --region <REGION>

A file system fails if Status is DISABLED or DISABLING, or if the command returns a PolicyNotFound error.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EFS console and select **File systems**.
    
3.  Select the file system and choose **Edit**.
    
4.  Select **Enable automatic backups**.
    
5.  Choose **Save changes**.
    
6.  Repeat for each affected file system in each region in use.
    

**CLI:**

Enable automatic backups for a file system:

aws efs put-backup-policy --file-system-id <FILE\_SYSTEM\_ID> --backup-policy Status=ENABLED --region <REGION>

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EFS console and select **File systems**.
    
3.  Select the file system and choose **Edit**.
    
4.  Clear **Enable automatic backups**.
    
5.  Choose **Save changes**.
    

**CLI:**

aws efs put-backup-policy --file-system-id <FILE\_SYSTEM\_ID> --backup-policy Status=DISABLED --region <REGION>

Note: disabling automatic backups stops new backups; existing recovery points stay in the backup vault until they expire or are deleted. Without backups, lost data cannot be recovered.

**Reference**

-   [https://docs.aws.amazon.com/efs/latest/ug/automatic-backups.html](https://docs.aws.amazon.com/efs/latest/ug/automatic-backups.html)
    
-   [https://docs.aws.amazon.com/efs/latest/ug/awsbackup.html](https://docs.aws.amazon.com/efs/latest/ug/awsbackup.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/efs/put-backup-policy.html](https://docs.aws.amazon.com/cli/latest/reference/efs/put-backup-policy.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.