Back to Checks
aws

EFS file system has encryption at rest enabled

efs_encryption_at_rest_enabled
Service: efsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsEfsFileSystem

Amazon EFS file system has encryption at rest enabled using AWS KMS to protect file data and metadata stored on the service

Prowler logoProwlerprowler-provider-aws

Risk

Without encryption at rest, EFS contents can be read from storage media, backups, or compromised hosts, eroding confidentiality and enabling offline exfiltration. Privileged compromise also allows covert data harvesting or manipulation, threatening integrity of files.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks efs_encryption_at_rest_enabled

Recommendation

Enable encryption at rest for all EFS file systems and prefer customer-managed KMS keys for control, rotation, and audit. Apply least privilege to key policies and separate key management duties. For existing unencrypted data, migrate to a new encrypted file system. Enforce creation policies (IAM/SCP) to prevent non-encrypted deployments.

Remediation

Terraform

# Terraform: Create an EFS file system with encryption at rest enabled
resource "aws_efs_file_system" "<example_resource_name>" {
  encrypted = true  # Critical: enables encryption at rest so the check passes
}

NativeIaC

# CloudFormation: Create an EFS file system with encryption at rest enabled
Resources:
  <example_resource_name>:
    Type: AWS::EFS::FileSystem
    Properties:
      Encrypted: true  # Critical: enables encryption at rest so the check passes

Other

1In the AWS Console, go to Amazon EFS
2Click Create file system
3Check Enable encryption (leave default key or choose a KMS key if required)
4Click Create
5Migrate data from the unencrypted file system to the new encrypted one
6Delete the unencrypted file system to clear the failing finding

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.efs.efs_client import efs_client


class efs_encryption_at_rest_enabled(Check):
    def execute(self):
        findings = []
        for fs in efs_client.filesystems.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=fs)
            report.status = "FAIL"
            report.status_extended = (
                f"EFS {fs.id} does not have encryption at rest enabled."
            )
            if fs.encrypted:
                report.status = "PASS"
                report.status_extended = f"EFS {fs.id} has encryption at rest enabled."

            findings.append(report)

        return findings

References