FSx file system has copy tags to volumes enabled

Check ID: fsx_file_system_copy_tags_to_volumes_enabled
Provider: AWS
Service: fsx
Severity: LOW
Resource type: Other

What this check verifies

Amazon FSx file systems are configured to copy tags to volumes via copy_tags_to_volumes. Identifies file systems where volume resources will not inherit the file system’s tags.

Risk

Without tag propagation, volumes lack consistent labels used for ABAC, classification, and automation. This can erode confidentiality through mis-scoped access controls and impact availability if backups or safeguards aren’t applied to untagged volumes.

Recommendation

Enable copy_tags_to_volumes and adopt a mandatory tagging policy (owner, environment, data class). Apply least privilege/ABAC using tags and integrate tags into backup, retention, and monitoring workflows to enforce defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws fsx update-file-system --file-system-id <file-system-id> --open-zfs-configuration CopyTagsToVolumes=true

# FSx for OpenZFS with copy tags to volumes enabled
resource "aws_fsx_openzfs_file_system" "<example_resource_name>" {
  deployment_type      = "SINGLE_AZ_1"
  subnet_ids           = ["<example_resource_id>"]
  throughput_capacity  = 64
  copy_tags_to_volumes = true  # Critical: ensures volumes inherit file system tags
}

# CloudFormation: Enable copying tags to volumes for FSx for OpenZFS
Resources:
  <example_resource_name>:
    Type: AWS::FSx::FileSystem
    Properties:
      FileSystemType: OPENZFS
      SubnetIds:
        - <example_resource_id>
      OpenZFSConfiguration:
        DeploymentType: SINGLE_AZ_1
        ThroughputCapacity: 64
        CopyTagsToVolumes: true  # Critical: ensures volumes inherit file system tags

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = fsx_file_system_copy_tags_to_volumes_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

FSx file system has copy tags to backups enabled FSx Windows file system uses Multi-AZ deployment

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires