Back to Checks
aws

EFS file system has all access points with a defined POSIX user

efs_access_point_enforce_user_identity
Service: efsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsEfsAccessPoint

Amazon EFS access points are evaluated for a defined POSIX user (uid, gid, optional secondary groups). The check inspects each access point on a file system and flags those without a configured POSIX user identity.

Prowler logoProwlerprowler-provider-aws

Risk

Without enforced POSIX identity, NFS clients can supply arbitrary UIDs/GIDs, enabling impersonation, unauthorized reads/writes, and ownership spoofing. This undermines confidentiality and integrity of shared data and can enable lateral movement across applications sharing the file system.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks efs_access_point_enforce_user_identity

Recommendation

Enforce a POSIX user identity on every access point using least-privilege uid/gid (avoid 0). Apply separation of duties with dedicated access points per application and minimal groups. Use IAM to require access point usage and add defense in depth by enforcing a restricted root directory.

Remediation

Terraform

resource "aws_efs_access_point" "example" {
  file_system_id = "<example_resource_id>"

  # Critical: enforces a POSIX user for all requests via this access point
  posix_user {
    uid = 1000  # Critical: user ID enforced
    gid = 1000  # Critical: group ID enforced
  }
}

NativeIaC

Resources:
  ExampleAccessPoint:
    Type: AWS::EFS::AccessPoint
    Properties:
      FileSystemId: "<example_resource_id>"
      PosixUser:               # Critical: enforces a POSIX user for all requests via this access point
        Uid: "<uid>"          # Critical: POSIX user ID enforced
        Gid: "<gid>"          # Critical: POSIX group ID enforced

Other

1In the AWS Console, go to Amazon EFS > Access points
2Click Create access point, select the file system, and set POSIX user: enter User ID and Group ID
3Click Create access point
4Update clients to mount using the new access point ID
5Delete the old access point(s) that lack a POSIX user

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.efs.efs_client import efs_client


class efs_access_point_enforce_user_identity(Check):
    def execute(self):
        findings = []
        for fs in efs_client.filesystems.values():
            if fs.access_points:
                report = Check_Report_AWS(metadata=self.metadata(), resource=fs)
                report.status = "PASS"
                report.status_extended = (
                    f"EFS {fs.id} has all access points with defined POSIX user."
                )

                access_points = []
                for access_point in fs.access_points:
                    if not access_point.posix_user:
                        access_points.append(access_point)
                if access_points:
                    report.status = "FAIL"
                    report.status_extended = f"EFS {fs.id} has access points with no POSIX user: {', '.join([ap.id for ap in access_points])}."
                findings.append(report)
        return findings

References