EFS access points do not expose the root directory

Check ID: efs_access_point_enforce_root_directory
Provider: AWS
Service: efs
Severity: MEDIUM
Categories: vulnerabilities
Resource type: AwsEfsAccessPoint

What this check verifies

Amazon EFS access points are evaluated to ensure they enforce a non-root directory. The check identifies access points whose configured root directory Path is /, meaning clients would mount the file system’s root instead of a scoped subdirectory.

Risk

Exposing the file system root via an access point undermines confidentiality and integrity by allowing traversal beyond intended datasets. Attackers or misconfigured apps could:

Read sensitive directories
Modify or delete shared data
Pivot across tenants, impacting availability

Recommendation

Apply least privilege: set each access point Path to a dedicated subdirectory and avoid /.

Use per-application access points
Enforce POSIX identity and directory permissions
Layer controls (network segmentation, monitoring) for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws efs delete-access-point —access-point-id <access-point-id>

# Terraform: EFS access point enforcing a non-root directory
resource "aws_efs_access_point" "<example_resource_name>" {
  file_system_id = "<example_resource_id>"

  root_directory {
    path = "/data"  # Critical: not "/"; enforces a subdirectory as root to pass the check
  }
}

# CloudFormation: EFS access point enforcing a non-root directory
Resources:
  <example_resource_name>:
    Type: AWS::EFS::AccessPoint
    Properties:
      FileSystemId: <example_resource_id>
      RootDirectory:
        Path: /data  # Critical: set to a non-root path to avoid "/" and pass the check
        # This enforces the access point root to /data instead of the file system root

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = efs_access_point_enforce_root_directory. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ECS task set does not assign a public IP address EFS access points all define a POSIX user

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires