Skip to main content

Not encrypting data at rest can lead to data leak

SeverityExploitabilityProvidersCategories
HIGHMEDIUMAWSDATA

Description#

Amazon Elastic File System (Amazon EFS) provides serverless, set-and-forget elastic file system for use with AWS Cloud services and on-premises resources.

Encrypting your volumes ensures that your application runtime data will not be compromised from unauthorized access to the data layer.

Impact#

Potential data exposureVisible in logsUser interaction requiredPrivileges required
TrueFalseFalseTrue

Data leak.

Remediation guidelines#

Since it is not possible to encrypt an existing unencrypted file system, you will have to perform manual steps:

  1. Create a backup of your EFS.
  2. Create a new EFS with encryption enabled.
  3. Restore the backup to the new EFS.
  4. Delete the unencrypted EFS.

References#