EFS file system policy is not open to the whole VPC

Check ID: efs_not_publicly_accessible
Provider: AWS
Service: efs
Severity: MEDIUM
Categories: identity-access, internet-exposed
Resource type: AwsEfsFileSystem

What this check verifies

Amazon EFS file system policy is assessed for public or VPC-wide access. Policies with broad Principal values or that permit any client in the VPC without the elasticfilesystem:AccessedViaMountTarget condition are identified. An absent or empty policy is treated as open to VPC clients.

Risk

Broad EFS access lets any VPC client-or a compromised workload-mount the share, impacting CIA:

Confidentiality: bulk data exfiltration
Integrity: unauthorized writes or ransomware
Availability: deletion or lockout via elevated client access Also facilitates lateral movement within the VPC.

Recommendation

Apply least privilege to EFS resource policies:

Avoid wildcard Principal or *
Require elasticfilesystem:AccessedViaMountTarget=true
Constrain with aws:SourceVpc, aws:SourceAccount, or org IDs
Use EFS access points per app/role
Enable EFS Block Public Access for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws efs put-file-system-policy --file-system-id <example_resource_id> --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"elasticfilesystem:ClientMount","Condition":{"Bool":{"elasticfilesystem:AccessedViaMountTarget":"true"}}}]}'

# Attach a non-public EFS file system policy
resource "aws_efs_file_system_policy" "<example_resource_name>" {
  file_system_id = "<example_resource_id>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "elasticfilesystem:ClientMount"
      Condition = {
        Bool = {
          "elasticfilesystem:AccessedViaMountTarget" = "true" # Critical: require mount target to make policy non-public
        }
      }
    }]
  })
}

# CloudFormation: attach a non-public EFS file system policy
Resources:
  EFSFileSystemPolicy:
    Type: AWS::EFS::FileSystemPolicy
    Properties:
      FileSystemId: <example_resource_id>
      Policy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: "*"
            Action: elasticfilesystem:ClientMount
            Condition:
              Bool:
                elasticfilesystem:AccessedViaMountTarget: "true"  # Critical: restrict access to mount targets only to avoid public access

In the AWS Console, go to EFS > File systems and select <example_resource_id>
Open the File system policy tab and click Edit

Replace the policy with one that requires access via mount targets only:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "elasticfilesystem:ClientMount",
      "Condition": {"Bool": {"elasticfilesystem:AccessedViaMountTarget": "true"}}
    }
  ]
}

Save changes

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = efs_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EFS file system is Multi-AZ with more than one mount target EKS cluster has deletion protection enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires