Rule: EFS Access Points Should Enforce a User Identity

EFS Access Points User Identity Enforcement

Rule Description:

Troubleshooting Steps (if applicable):

Necessary Codes (if applicable):

Step-by-Step Remediation:

2. 1.

   Identify EFS Access Points: Firstly, identify the EFS access points that need to have user identity enforcement. You can refer to the AWS Management Console or use the AWS Command Line Interface (CLI) to list and view all the existing EFS access points.

4. 2.

   Review Current Settings: Check the current settings for the identified EFS access points to see if user identity enforcement is already enabled or not. Using the AWS Management Console or CLI, access the details of each access point and verify the configuration.

6. 3.

   Enable User Identity Enforcement: If user identity enforcement is not already enabled, proceed with enabling it for each of the EFS access points. You can do this through the AWS Management Console or CLI. Below are the steps for both methods:

   Using AWS Management Console:

   • Open the AWS Management Console and go to the Amazon EFS section.
   • Select the appropriate access point from the list.
   • Under the "Network Access" tab, locate the "Permissions" section.
   • Click on "Edit" next to "Identities."
   • Select "Require access via AWS Identity and Access Management (IAM) roles or IAM users" option.
   • Save the changes.

   Using AWS CLI: (Assuming the AWS CLI is already installed and configured)

   • Open the command prompt/terminal and run the following command:

     aws efs put-access-point-policy --access-point-id <your-access-point-id> --policy `<policy-document>`
     

     Replace

     <your-access-point-id>

     with the ID of the access point and

     <policy-document>

     with the desired policy document that enforces user identity.
8. 4.

   Test and Validate: After enabling user identity enforcement, verify that the changes have taken effect. Attempt accessing the EFS file systems associated with the access points using an unauthorized user or an IAM role without the necessary permissions. The access should be denied, confirming the successful implementation of the rule.

10. 5.

    Continuous Monitoring: Regularly monitor the access points and associated file systems to ensure user identity enforcement is maintained. Monitor access logs, review access policies, and perform periodic security assessments to identify any potential configuration deviations or security concerns.