EFS file system has backup enabled

Check ID: efs_have_backup_enabled
Provider: AWS
Service: efs
Severity: MEDIUM
Categories: resilience
Resource type: AwsEfsFileSystem

What this check verifies

Amazon EFS file systems are assessed for automated backups configured via the backup policy. The finding highlights file systems where backups are not enabled or are being disabled.

Risk

Absence of EFS backups degrades availability and integrity. Accidental deletion, ransomware, or misconfiguration can wipe or corrupt data with no recovery path. Without point-in-time copies, RPO/RTO suffer and localized incidents can become prolonged outages and irreversible loss.

Recommendation

Enable automated EFS backups by setting the file system backup policy to ENABLED and applying defense-in-depth:

Schedule frequent jobs with tiered retention
Use immutable vaults and cross-Region copies
Restrict delete/restore via least privilege and separation of duties
Regularly test restores and document DR objectives

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws efs put-backup-policy --file-system-id <FILE_SYSTEM_ID> --backup-policy Status=ENABLED

# Enable automatic backups for EFS
resource "aws_efs_file_system" "<example_resource_name>" {
  backup_policy {
    status = "ENABLED"  # Critical: turns on EFS automatic backups
  }
}

# CloudFormation: Enable automatic backups for EFS
Resources:
  <example_resource_name>:
    Type: AWS::EFS::FileSystem
    Properties:
      BackupPolicy:
        Status: ENABLED  # Critical: turns on EFS automatic backups via AWS Backup

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = efs_have_backup_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EFS file system has encryption at rest enabled EFS file system has no publicly accessible mount targets

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires