Back to Checks
aws

EFS file system policy does not allow access to any client within the VPC

efs_not_publicly_accessible
Service: efsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accessinternet-exposed
Resource Type:AwsEfsFileSystem

Amazon EFS file system policy is assessed for public or VPC-wide access. Policies with broad Principal values or that permit any client in the VPC without the elasticfilesystem:AccessedViaMountTarget condition are identified.

An absent or empty policy is treated as open to VPC clients.

Prowler logoProwlerprowler-provider-aws

Risk

Broad EFS access lets any VPC client-or a compromised workload-mount the share, impacting CIA:

  • Confidentiality: bulk data exfiltration
  • Integrity: unauthorized writes or ransomware
  • Availability: deletion or lockout via elevated client access Also facilitates lateral movement within the VPC.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks efs_not_publicly_accessible

Recommendation

Apply least privilege to EFS resource policies:

  • Avoid wildcard Principal or *
  • Require elasticfilesystem:AccessedViaMountTarget=true
  • Constrain with aws:SourceVpc, aws:SourceAccount, or org IDs
  • Use EFS access points per app/role
  • Enable EFS Block Public Access for defense in depth

Remediation

CLI

aws efs put-file-system-policy --file-system-id <example_resource_id> --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"elasticfilesystem:ClientMount","Condition":{"Bool":{"elasticfilesystem:AccessedViaMountTarget":"true"}}}]}'

Terraform

# Attach a non-public EFS file system policy
resource "aws_efs_file_system_policy" "<example_resource_name>" {
  file_system_id = "<example_resource_id>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "elasticfilesystem:ClientMount"
      Condition = {
        Bool = {
          "elasticfilesystem:AccessedViaMountTarget" = "true" # Critical: require mount target to make policy non-public
        }
      }
    }]
  })
}

NativeIaC

# CloudFormation: attach a non-public EFS file system policy
Resources:
  EFSFileSystemPolicy:
    Type: AWS::EFS::FileSystemPolicy
    Properties:
      FileSystemId: <example_resource_id>
      Policy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: "*"
            Action: elasticfilesystem:ClientMount
            Condition:
              Bool:
                elasticfilesystem:AccessedViaMountTarget: "true"  # Critical: restrict access to mount targets only to avoid public access

Other

1In the AWS Console, go to EFS > File systems and select <example_resource_id>
2Open the File system policy tab and click Edit
3Replace the policy with one that requires access via mount targets only:
4```json
5{
6"Version": "2012-10-17",
7"Statement": [
8{
9"Effect": "Allow",
10"Principal": "*",
11"Action": "elasticfilesystem:ClientMount",
12"Condition": {"Bool": {"elasticfilesystem:AccessedViaMountTarget": "true"}}
13}
14]
15}
16```
17Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.efs.efs_client import efs_client
from prowler.providers.aws.services.iam.lib.policy import is_policy_public


class efs_not_publicly_accessible(Check):
    def execute(self):
        findings = []
        for fs in efs_client.filesystems.values():
            if fs.policy is None:
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=fs)
            report.status = "PASS"
            report.status_extended = f"EFS {fs.id} has a policy which does not allow access to any client within the VPC."
            if not fs.policy:
                report.status = "FAIL"
                report.status_extended = f"EFS {fs.id} doesn't have any policy which means it grants full access to any client within the VPC."
            elif is_policy_public(fs.policy, efs_client.audited_account) and any(
                statement.get("Condition", {})
                .get("Bool", {})
                .get("elasticfilesystem:AccessedViaMountTarget", "false")
                != "true"
                for statement in fs.policy.get("Statement", [])
            ):
                report.status = "FAIL"
                report.status_extended = f"EFS {fs.id} has a policy which allows access to any client within the VPC."
            findings.append(report)
        return findings

References