EFS file system is Multi-AZ with more than one mount target

Check ID: efs_multi_az_enabled
Provider: AWS
Service: efs
Severity: MEDIUM
Categories: resilience
Resource type: AwsEfsFileSystem

What this check verifies

Amazon EFS file systems are assessed for multi-AZ resilience: Regional type (no availability_zone_id) with mount targets in more than one Availability Zone. Single-AZ (One Zone) or Regional with only one mount target is identified for attention.

Risk

Concentrating access through a single AZ or a lone mount target reduces availability. An AZ outage can sever client connectivity, causing downtime and I/O errors. A single mount target also forces cross-AZ traffic, increasing latency and costs and undermining resilience and seamless failover.

Recommendation

Use Regional EFS and create mount targets in each required Availability Zone to remove single points of failure and keep clients local to their AZ. Avoid One Zone for critical data. Periodically review mount target distribution to uphold high availability and fault tolerance.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws efs create-mount-target —file-system-id <FILE_SYSTEM_ID> —subnet-id <SUBNET_ID>

# Add an extra EFS mount target in a different AZ/subnet
resource "aws_efs_mount_target" "<example_resource_name>" {
  file_system_id = "<example_resource_id>"  # FIX: target EFS
  subnet_id      = "<example_resource_id>"  # FIX: subnet in another AZ to make targets > 1
}

# CloudFormation: add an extra EFS mount target to another AZ
Resources:
  <example_resource_name>:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: fs-<example_resource_id>  # FIX: adds another mount target for this EFS
      SubnetId: subnet-<example_resource_id>  # FIX: choose a subnet in a different AZ
      SecurityGroups:
        - <example_security_group_id>         # Required by CFN

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = efs_multi_az_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EFS file system has no publicly accessible mount targets EFS file system policy is not open to the whole VPC

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires