EFS-01: EFS state filesystem security¶
| Property | Value |
|---|---|
| Severity | medium |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- EFS filesystem is CMK-encrypted, enforces TLS via policy, and has backups enabled.
How to fix¶
- Encrypt the filesystem with a customer-managed KMS CMK; attach a filesystem policy that denies non-TLS access and scopes mount to the enclave host's role; and enable AWS Backup. For EBS-backed state, encrypt volumes with a CMK and ensure snapshots are not shared publicly.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No EFS filesystem ID specified; skipping check.
ERROR:
- EFS filesystem … not found.
- Could not describe EFS filesystem: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--efs-id |
EFS filesystem ID mounted for enclave state. |
--region |
AWS region. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| AWS | efs.describe_backup_policy |
elasticfilesystem:DescribeBackupPolicy |
read |
| AWS | efs.describe_file_system_policy |
elasticfilesystem:DescribeFileSystemPolicy |
read |
| AWS | efs.describe_file_systems |
elasticfilesystem:DescribeFileSystems |
read |
| AWS | kms.describe_key |
kms:DescribeKey |
read |
Every AWS scan also calls sts:GetCallerIdentity. See Required permissions for a complete policy.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).