Control: 1 Amazon EFS should be configured to encrypt file data at rest using AWS KMS


This control checks whether Amazon Elastic File System is configured to encrypt the file data using AWS KMS. The check fails in the following cases.

Note that this control does not use the KmsKeyId parameter for efs-encrypted-check. It only checks the value of Encrypted.

For an added layer of security for your sensitive data in Amazon EFS, you should create encrypted file systems. Amazon EFS supports encryption for file systems at-rest. You can enable encryption of data at rest when you create an Amazon EFS file system. To learn more about Amazon EFS encryption, see Data encryption in Amazon EFS.


For details on how to encrypt a new Amazon EFS file system, see Encrypting data at rest.


steampipe check aws_compliance.control.foundational_security_efs_1


This control uses a named query: