1. Open the AWS Management Console and navigate to the Amazon Elastic File System (EFS) service.
2. Select the EFS file system that needs to be remediated.
3. Click on the “Actions” button and select “Modify file system”.
4. In the “Modify file system” window, scroll down to the “Encryption” section.
5. Disable the encryption by selecting “No” for the “Encrypt file system” option.
6. Click on the “Modify” button to save the changes.
7. Once the changes are saved, the EFS file system will be unencrypted.

​

1. Open the AWS CLI on your local machine.
2. Run the following command to get a list of all the EFS file systems in your AWS account:

aws efs describe-file-systems

3. Identify the EFS file system that has encryption disabled.
4. Run the following command to enable encryption for the identified EFS file system:

aws efs update-file-system --file-system-id <file-system-id> --encrypted

5. Verify that encryption is enabled for the EFS file system by running the following command:

aws efs describe-file-systems --file-system-id <file-system-id> --query "FileSystems[*].Encrypted"

6. Repeat the above steps for all the EFS file systems in your AWS account that have encryption disabled.

1. Open the AWS console and navigate to the EFS service.
2. Select the EFS file system that has encryption enabled.
3. Click on the “Modify” button in the top menu bar.
4. Scroll down to the “Encryption” section and select “No” in the “Encryption” dropdown menu.
5. Click on the “Save” button to disable encryption for the EFS file system.

import boto3

# Create an EFS client
efs = boto3.client('efs')

# Set the EFS file system ID
file_system_id = 'fs-12345678'

# Disable encryption for the EFS file system
response = efs.modify_file_system(
    FileSystemId=file_system_id,
    Encrypted=False
)

# Print the response
print(response)

resource "aws_efs_file_system" "THIS_FILE_SYSTEM" {
  # Replace THIS_FILE_SYSTEM with a meaningful name or keep as-is if matching an existing resource
  creation_token = "UNIQUE_CREATION_TOKEN_FOR_THIS_FS" # replace with a stable unique string

  # This is the setting that fixes the finding:
  encrypted  = true
  kms_key_id = aws_kms_key.EFS_KMS_KEY.arn # or "arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID"

  performance_mode = "generalPurpose"

  tags = {
    Name = "EFS_ENCRYPTED_FS_NAME" # replace with your file system name
  }
}

resource "aws_kms_key" "EFS_KMS_KEY" {
  description             = "KMS key for encrypting EFS file system"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  tags = {
    Name = "efs-kms-key"
  }
}

• creating a new aws_efs_file_system with encrypted: "true" and the desired kms_key_id, or
• replacing the existing file system where the diff includes encrypted: "false" => "true" (and/or a change to kms_key_id) with -/+ on the resource.