cis-aws-foundations-3-3-1

name	cis-aws-foundations-3.3.1
description	Ensure that encryption is enabled for EFS file systems
category	cis-storage
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","storage","efs","encryption","encryption-at-rest","kms"]
cis_id	3.3.1
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure that encryption is enabled for EFS file systems

Description

EFS data should be encrypted at rest using AWS KMS (Key Management Service).

Rationale

Data should be encrypted at rest to reduce the risk of a data breach via direct access to the storage device.

Impact

EFS file system data-at-rest encryption must be turned on when creating the file system. If an EFS file system has been created without data-at-rest encryption enabled, then you must create another EFS file system with the correct configuration and transfer the data. There is no way to enable encryption on an existing unencrypted EFS file system.

Audit Procedure

Using AWS Console

1. Login to the AWS Management Console and Navigate to the Elastic File System (EFS) dashboard.
2. Select File Systems from the left navigation panel.
3. Each item on the list has a visible Encrypted field that displays data at rest encryption status.
4. Validate that this field reads Encrypted for all EFS file systems in all AWS regions.

Using AWS CLI

1. Run the describe-file-systems command using custom query filters to list the identifiers of all AWS EFS file systems currently available within the selected region:

aws efs describe-file-systems --region --output table --query 'FileSystems[*].[FileSystemId,Encrypted]' --output table

2. The command output should return a table with the requested file system IDs.

3. Run the describe-file-systems command using the ID of the file system that you want to examine as file-system-id and the necessary query filters:

aws efs describe-file-systems --region <region> --file-system-id <file-system-id> --query 'FileSystems[*].Encrypted'

4. The command output should return the file system encryption status as true or false. If the returned value is false, the selected AWS EFS file system is not encrypted and if the returned value is true, the selected AWS EFS file system is encrypted.

Expected Result

The Encrypted field should return true for all EFS file systems, indicating that encryption at rest is enabled using AWS KMS.

Remediation