EFS file system is not encrypted at rest

Severity: Medium
Service: EFS
Check ID: EFS_NOT_ENCRYPTED

What this check finds

Unencrypted EFS file systems expose data if the underlying storage media is compromised. Encryption must be enabled at creation time — it cannot be added to an existing file system. This is a compliance baseline for PCI-DSS, HIPAA, and SOC 2.

Passing looks like: EFS encrypted at rest.

How to fix it

Create a new EFS file system with encryption enabled and migrate data to it.

AWS CLI

aws efs create-file-system --encrypted --kms-key-id KEY_ARN

Data migration can be performed with AWS DataSync.

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

EFS → Create file system → Customise → Encryption → Enable.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to EFS file system is not encrypted at rest
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	2.3.1 Ensure that encryption is enabled for EFS file systems
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
HIPAA Security Rule	164.312(a)(2)(iv) Encryption and Decryption of ePHI at Rest
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-13 Cryptographic Protection SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs