Check ID: efs_mount_target_not_publicly_accessible
Provider: AWS
Service: efs
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsEfsFileSystem

​
What this check verifies

EFS mount targets associated with VPC subnets that auto-assign public IPv4 addresses (mapPublicIpOnLaunch=true) are identified per file system. The evaluation focuses on the subnet attribute linked to each mount target.

​
Risk

Publicly addressable mount targets expose NFS to Internet scanning and exploit attempts.
  • Confidentiality: unauthorized reads
  • Integrity: illicit writes or deletion
  • Availability: DDoS/resource exhaustion
Even with tight rules, a public IP weakens isolation and eases recon.

​
Recommendation

Place mount targets in private subnets that do not auto-assign public IPs (mapPublicIpOnLaunch=false). Apply least privilege: restrict NFS via security groups to known sources, avoid Internet routes, and use defense in depth with NACLs. Prefer private connectivity (VPN/Direct Connect or peering) for access.

​
Remediation

# Create an EFS mount target in a private subnet
resource "aws_efs_mount_target" "<example_resource_name>" {
  file_system_id  = "<example_resource_id>"
  subnet_id       = "<example_resource_id>"  # FIX: Use a private subnet (no route to an Internet Gateway)
  security_groups = ["<example_resource_id>"]
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = efs_mount_target_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks