Back to Checks
aws

EFS file system has no publicly accessible mount targets

efs_mount_target_not_publicly_accessible
Service: efsSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEfsFileSystem

EFS mount targets associated with VPC subnets that auto-assign public IPv4 addresses (mapPublicIpOnLaunch=true) are identified per file system.

The evaluation focuses on the subnet attribute linked to each mount target.

Prowler logoProwlerprowler-provider-aws

Risk

Publicly addressable mount targets expose NFS to Internet scanning and exploit attempts.

  • Confidentiality: unauthorized reads
  • Integrity: illicit writes or deletion
  • Availability: DDoS/resource exhaustion

Even with tight rules, a public IP weakens isolation and eases recon.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks efs_mount_target_not_publicly_accessible

Recommendation

Place mount targets in private subnets that do not auto-assign public IPs (mapPublicIpOnLaunch=false). Apply least privilege: restrict NFS via security groups to known sources, avoid Internet routes, and use defense in depth with NACLs. Prefer private connectivity (VPN/Direct Connect or peering) for access.

Remediation

Terraform

# Create an EFS mount target in a private subnet
resource "aws_efs_mount_target" "<example_resource_name>" {
  file_system_id  = "<example_resource_id>"
  subnet_id       = "<example_resource_id>"  # FIX: Use a private subnet (no route to an Internet Gateway)
  security_groups = ["<example_resource_id>"]
}

NativeIaC

# Create an EFS mount target in a private subnet
Resources:
  <example_resource_name>:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: <example_resource_id>
      SubnetId: <example_resource_id>  # FIX: Use a private subnet (no route to an Internet Gateway)
      SecurityGroups:
        - <example_resource_id>  # Required SG for the mount target

Other

1Open the AWS Console > EFS > File systems > select your file system
2Go to Networking and click Create mount target
3Choose a subnet that is private (no route to an Internet Gateway) and select a security group
4Click Create
5In Networking, select any mount targets in public subnets and click Delete to remove them

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.efs.efs_client import efs_client
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class efs_mount_target_not_publicly_accessible(Check):
    def execute(self):
        findings = []
        for fs in efs_client.filesystems.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=fs)
            report.status = "PASS"
            report.status_extended = (
                f"EFS {fs.id} does not have any public mount targets."
            )
            mount_targets = []
            for mt in fs.mount_targets:
                if vpc_client.vpc_subnets[mt.subnet_id].public:
                    mount_targets.append(mt)
            if mount_targets:
                report.status = "FAIL"
                report.status_extended = f"EFS {fs.id} has public mount targets: {', '.join([mt.id for mt in mount_targets])}"

            findings.append(report)
        return findings

References