Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-3-3-1El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | cis-aws-foundations-3.3.1 |
| description | Ensure that encryption is enabled for EFS file systems |
| category | cis-storage |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","efs","encryption","encryption-at-rest","kms"] |
| cis_id | 3.3.1 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
EFS data should be encrypted at rest using AWS KMS (Key Management Service).
Data should be encrypted at rest to reduce the risk of a data breach via direct access to the storage device.
EFS file system data-at-rest encryption must be turned on when creating the file system. If an EFS file system has been created without data-at-rest encryption enabled, then you must create another EFS file system with the correct configuration and transfer the data. There is no way to enable encryption on an existing unencrypted EFS file system.
File Systems from the left navigation panel.Encrypted for all EFS file systems in all AWS regions.describe-file-systems command using custom query filters to list the identifiers of all AWS EFS file systems currently available within the selected region:aws efs describe-file-systems --region --output table --query 'FileSystems[*].[FileSystemId,Encrypted]' --output table
The command output should return a table with the requested file system IDs.
Run the describe-file-systems command using the ID of the file system that you want to examine as file-system-id and the necessary query filters:
aws efs describe-file-systems --region <region> --file-system-id <file-system-id> --query 'FileSystems[*].Encrypted'
true or false. If the returned value is false, the selected AWS EFS file system is not encrypted and if the returned value is true, the selected AWS EFS file system is encrypted.The Encrypted field should return true for all EFS file systems, indicating that encryption at rest is enabled using AWS KMS.
It is important to note that EFS file system data-at-rest encryption must be turned on when creating the file system. If an EFS file system has been created without data-at-rest encryption enabled, then you must create another EFS file system with the correct configuration and transfer the data.
Steps to create an EFS file system with data encrypted at rest:
Elastic File System (EFS) dashboard.File Systems from the left navigation panel.Create File System button from the dashboard top menu to start the file system setup process.Configure file system access configuration page, perform the following actions:
Create mount targets section, check the boxes for all of the Availability Zones (AZs) within the selected VPC. These will be your mount targets.Next step to continue.Configure optional settings page:
tags to describe your new file system.performance mode based on your requirements.Enable encryption box and choose aws/elasticfilesystem from the Select KMS master key dropdown list to enable encryption for the new file system, using the default master key provided and managed by AWS KMS.Next step to continue.review and create page and then click Create File System to create your new AWS EFS file system.describe-file-systems command to view the configuration information for the selected unencrypted file system identified in the Audit steps:aws efs describe-file-systems --region <region> --file-system-id <file-system-id>
The command output should return the configuration information.
To provision a new AWS EFS file system, you need to generate a universally unique identifier (UUID) to create the token required by the create-file-system command. To create the required token, you can use a randomly generated UUID from "https://www.uuidgenerator.net".
Run the create-file-system command using the unique token created at the previous step:
aws efs create-file-system --region <region> --creation-token <uuid> --performance-mode generalPurpose --encrypted
The command output should return the new file system configuration metadata.
Run the create-mount-target command using the EFS file system ID returned from step 4 as the identifier and the ID of the Availability Zone (AZ) that will represent the mount target:
aws efs create-mount-target --region <region> --file-system-id <file-system-id> --subnet-id <subnet-id>
The command output should return the new mount target metadata.
Now you can mount your file system from an EC2 instance.
Copy the data from the old unencrypted EFS file system to the newly created encrypted file system.
Remove the unencrypted file system as soon as your data migration to the newly created encrypted file system is completed:
aws efs delete-file-system --region <region> --file-system-id <unencrypted-file-system-id>
By default, when creating an EFS file system through the AWS Management Console, encryption at rest is enabled. When creating a file system using the AWS CLI, API, or SDKs, encryption is not enabled by default and must be explicitly specified.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.11 Encrypt Sensitive Data at Rest | x | x | |
| v7 | 14.8 Encrypt Sensitive Information at Rest | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1530 | TA0009 | M1041 |
Level 1 | Automated