Back to Checks
aws

EFS file system is Multi-AZ with more than one mount target

efs_multi_az_enabled
Service: efsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsEfsFileSystem

Amazon EFS file systems are assessed for multi-AZ resilience: Regional type (no availability_zone_id) with mount targets in more than one Availability Zone. Single-AZ (One Zone) or Regional with only one mount target is identified for attention.

Prowler logoProwlerprowler-provider-aws

Risk

Concentrating access through a single AZ or a lone mount target reduces availability. An AZ outage can sever client connectivity, causing downtime and I/O errors. A single mount target also forces cross-AZ traffic, increasing latency and costs and undermining resilience and seamless failover.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks efs_multi_az_enabled

Recommendation

Use Regional EFS and create mount targets in each required Availability Zone to remove single points of failure and keep clients local to their AZ. Avoid One Zone for critical data. Periodically review mount target distribution to uphold high availability and fault tolerance.

Remediation

CLI

aws efs create-mount-target --file-system-id <FILE_SYSTEM_ID> --subnet-id <SUBNET_ID>

Terraform

# Add an extra EFS mount target in a different AZ/subnet
resource "aws_efs_mount_target" "<example_resource_name>" {
  file_system_id = "<example_resource_id>"  # FIX: target EFS
  subnet_id      = "<example_resource_id>"  # FIX: subnet in another AZ to make targets > 1
}

NativeIaC

# CloudFormation: add an extra EFS mount target to another AZ
Resources:
  <example_resource_name>:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: fs-<example_resource_id>  # FIX: adds another mount target for this EFS
      SubnetId: subnet-<example_resource_id>  # FIX: choose a subnet in a different AZ
      SecurityGroups:
        - <example_security_group_id>         # Required by CFN

Other

1In AWS Console, go to EFS > File systems > select your file system
2If File system type shows Regional: open the Network tab > Mount targets > Manage mount targets > Add mount target
3Select a subnet in a different Availability Zone and save
4If File system type shows One Zone: create a new EFS with File system type = Regional and create mount targets in at least two AZs; remount clients to the new file system and decommission the old one

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.efs.efs_client import efs_client


class efs_multi_az_enabled(Check):
    def execute(self):
        findings = []
        for fs in efs_client.filesystems.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=fs)
            if fs.availability_zone_id:
                report.status = "FAIL"
                report.status_extended = f"EFS {fs.id} is a Single-AZ file system."
            else:
                if fs.number_of_mount_targets <= 1:
                    report.status = "FAIL"
                    report.status_extended = f"EFS {fs.id} is a Multi-AZ file system but with only one mount target."
                else:
                    report.status = "PASS"
                    report.status_extended = f"EFS {fs.id} is a Multi-AZ file system with more than one mount target."

            findings.append(report)

        return findings

References