EFS Security
Storage & DatabaseAmazon EFS (Elastic File System) provides scalable NFS file storage. Security is managed through multiple layers.
Network Security
- EFS mount targets live in VPC subnets - accessible only from within the VPC
- Security groups on mount targets control which EC2 instances or containers can connect
- No public access possible - EFS is VPC-only by design
Encryption
- At Rest: AES-256 using KMS; must be enabled at creation
- In Transit: TLS 1.2 encryption using the EFS mount helper
Access Control
- IAM Authorization: file system policies and IAM identity policies for mount/read/write
- Access Points: enforce POSIX user/group identity and root directory per application
- POSIX Permissions: standard Unix file permissions (owner, group, other)
Related Content
Related Terms
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
Protecting data as it moves between systems by encrypting the communication channel, typically using TLS/SSL to prevent interception or tampering.
A virtual firewall for EC2 instances and other resources that controls inbound and outbound traffic at the instance level using allow rules.
An isolated virtual network within AWS where you launch resources, with full control over IP addressing, subnets, route tables, and network gateways.
KloudSec, built by the team behind Toc Consulting
See EFS Security checked automatically, continuously
What you just read is a manual, one-time check. KloudSec runs this and 400+ more automated checks across 90+ AWS services, continuously, agentless, live in about 5 minutes.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.