EFS file system can be mounted by anyone who reaches it
- Severity
- High
- Service
- EFS
- Check ID
- EFS_NO_IAM_POLICY
What this check finds
The file system has no file-system policy, or its policy grants elasticfilesystem:ClientMount to every principal with no condition beyond TLS or mount-target access. Any client that reaches a mount target on port 2049 can then mount it and read its files; the network is the only control.
Passing looks like: EFS mounting requires IAM.
How to fix it
Add a file-system policy that grants elasticfilesystem:ClientMount only to the IAM roles that need it, and mount with IAM authorisation (mount -t efs -o tls,iam).
AWS CLI
aws efs put-file-system-policy --file-system-id FS_ID --policy file://policy.json
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
EFS → File systems → select the file system → File system policy → Edit → add a statement allowing ClientMount for the role principals only.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs