Check ID: efs_access_point_enforce_user_identity
Provider: AWS
Service: efs
Severity: MEDIUM
Categories: identity-access
Resource type: AwsEfsAccessPoint

​
What this check verifies

Amazon EFS access points are evaluated for a defined POSIX user (uid, gid, optional secondary groups). The check inspects each access point on a file system and flags those without a configured POSIX user identity.

​
Risk

Without enforced POSIX identity, NFS clients can supply arbitrary UIDs/GIDs, enabling impersonation, unauthorized reads/writes, and ownership spoofing. This undermines confidentiality and integrity of shared data and can enable lateral movement across applications sharing the file system.

​
Recommendation

Enforce a POSIX user identity on every access point using least-privilege uid/gid (avoid 0). Apply separation of duties with dedicated access points per application and minimal groups. Use IAM to require access point usage and add defense in depth by enforcing a restricted root directory.

​
Remediation

resource "aws_efs_access_point" "example" {
  file_system_id = "<example_resource_id>"

  # Critical: enforces a POSIX user for all requests via this access point
  posix_user {
    uid = 1000  # Critical: user ID enforced
    gid = 1000  # Critical: group ID enforced
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = efs_access_point_enforce_user_identity. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks