cis-aws-storage-3-11

name	cis-aws-storage-3.11
description	Ensure accessing Points and IAM Policies for EFS
category	cis-storage-services
version	1.0.0
author	cyberstrike-official
tags	["cis","aws","storage","efs","iam","access-points","elasticfilesystem","access-control"]
cis_id	3.11
cis_benchmark	CIS AWS Storage Services Benchmark v1.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-storage-3.10"]
prerequisites	[]
severity_boost	{}

3.11 Ensure accessing Points and IAM Policies (Manual)

Profile Applicability

• Level 2

Description

You can use IAM policies to control access to your EFS access points. To achieve this, utilize the elasticfilesystem:AccessPointArn IAM condition key. The AccessPointArn represents the Amazon Resource Name (ARN) of the access point that the file system is mounted with.

Rationale

The rationale for using IAM policies with the elasticfilesystem:AccessPointArn condition key is to ensure precise and secure access control to EFS access points. By specifying the access point's ARN, you can restrict interactions to authorized users and resources only, thereby enhancing data security and preventing unauthorized access. This approach maintains the integrity and confidentiality of your data within the AWS environment.

Impact

Without using IAM policies with the elasticfilesystem:AccessPointArn condition key, access control to EFS access points becomes less precise, increasing the risk of unauthorized access. This lack of granular control can lead to potential security breaches, data exposure, and compliance violations. Consequently, your organization may face data integrity issues, financial losses, and damage to its reputation.

Audit Procedure

Console

Below is a sample IAM policy copied from the AWS documentation:

{
  "Version": "2012-10-17",
  "Id": "MyFileSystemPolicy",
  "Statement": [
    {
      "Sid": "App1Access",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:role/app1"