Check ID: efs_encryption_at_rest_enabled
Provider: AWS
Service: efs
Severity: MEDIUM
Categories: encryption
Resource type: AwsEfsFileSystem

​
What this check verifies

Amazon EFS file system has encryption at rest enabled using AWS KMS to protect file data and metadata stored on the service

​
Risk

Without encryption at rest, EFS contents can be read from storage media, backups, or compromised hosts, eroding confidentiality and enabling offline exfiltration. Privileged compromise also allows covert data harvesting or manipulation, threatening integrity of files.

​
Recommendation

Enable encryption at rest for all EFS file systems and prefer customer-managed KMS keys for control, rotation, and audit. Apply least privilege to key policies and separate key management duties. For existing unencrypted data, migrate to a new encrypted file system. Enforce creation policies (IAM/SCP) to prevent non-encrypted deployments.

​
Remediation

# Terraform: Create an EFS file system with encryption at rest enabled
resource "aws_efs_file_system" "<example_resource_name>" {
  encrypted = true  # Critical: enables encryption at rest so the check passes
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = efs_encryption_at_rest_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks