Back to Checks
aws

EFS file system has backup enabled

efs_have_backup_enabled
Service: efsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsEfsFileSystem

Amazon EFS file systems are assessed for automated backups configured via the backup policy. The finding highlights file systems where backups are not enabled or are being disabled.

Prowler logoProwlerprowler-provider-aws

Risk

Absence of EFS backups degrades availability and integrity. Accidental deletion, ransomware, or misconfiguration can wipe or corrupt data with no recovery path. Without point-in-time copies, RPO/RTO suffer and localized incidents can become prolonged outages and irreversible loss.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks efs_have_backup_enabled

Recommendation

Enable automated EFS backups by setting the file system backup policy to ENABLED and applying defense-in-depth:

  • Schedule frequent jobs with tiered retention
  • Use immutable vaults and cross-Region copies
  • Restrict delete/restore via least privilege and separation of duties
  • Regularly test restores and document DR objectives

Remediation

CLI

aws efs put-backup-policy --file-system-id <FILE_SYSTEM_ID> --backup-policy Status=ENABLED

Terraform

# Enable automatic backups for EFS
resource "aws_efs_file_system" "<example_resource_name>" {
  backup_policy {
    status = "ENABLED"  # Critical: turns on EFS automatic backups
  }
}

NativeIaC

# CloudFormation: Enable automatic backups for EFS
Resources:
  <example_resource_name>:
    Type: AWS::EFS::FileSystem
    Properties:
      BackupPolicy:
        Status: ENABLED  # Critical: turns on EFS automatic backups via AWS Backup

Other

1In the AWS Console, go to Amazon EFS > File systems
2Select the target file system
3Click Edit (or Update)
4Set Automatic backups to Enabled
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.efs.efs_client import efs_client


class efs_have_backup_enabled(Check):
    def execute(self):
        findings = []
        for fs in efs_client.filesystems.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=fs)
            report.status = "PASS"
            report.status_extended = f"EFS {fs.id} has backup enabled."
            if fs.backup_policy == "DISABLED" or fs.backup_policy == "DISABLING":
                report.status = "FAIL"
                report.status_extended = f"EFS {fs.id} does not have backup enabled."

            findings.append(report)

        return findings

References