Back to Checks
e2enetworks

E2E Networks EFS volumes restrict VPC access

storage_efs_vpc_access_restricted
Service: storageSeverity: medium
OfficialBuilt-inVerified
Resource Type:NotDefined

E2E Networks EFS volumes should restrict access to specific VPC resources instead of allowing every resource in the VPC to connect.

Prowler logoProwlerprowler-provider-e2enetworks

Risk

EFS volumes that allow all VPC resources broaden access beyond least privilege within the network, increasing the blast radius of a compromised resource.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler e2enetworks --checks storage_efs_vpc_access_restricted

Recommendation

Restrict EFS volume access to specific VPC resources instead of allowing all resources in the VPC.

Check Code

from prowler.lib.check.models import Check, CheckReportE2eNetworks
from prowler.providers.e2enetworks.services.storage.storage_client import storage_client


class storage_efs_vpc_access_restricted(Check):
    """Check if E2E Networks EFS volumes restrict VPC access."""

    def execute(self) -> list[CheckReportE2eNetworks]:
        findings = []
        for volume in storage_client.efs_volumes:
            report = CheckReportE2eNetworks(metadata=self.metadata(), resource=volume)
            report.status = "PASS"
            report.status_extended = (
                f"EFS volume {volume.name} does not allow all VPC resources."
            )
            if volume.is_all_vpc_resources_allowed:
                report.status = "FAIL"
                report.status_extended = (
                    f"EFS volume {volume.name} allows access from all VPC resources."
                )
            findings.append(report)
        return findings

References