More Info:
This rule checks if a recovery point was created for Amazon Elastic File System (Amazon EFS) File Systems. The rule is NON_COMPLIANT if the Amazon EFS File System does not have a corresponding Recovery Point created within the specified time period.Risk Level
HighAddress
ConfigurationCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- Cloudanix Best Practice
- DPDPA
- Digital Operational Resilience Act (EU)
- Essential 8
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of Elastic File System (EFS) not having a Recovery Point in AWS, you can follow these steps using the AWS Management Console:
- Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and log in to your AWS account.
- Navigate to Elastic File System (EFS): In the AWS Management Console, search for “EFS” in the search bar at the top and click on the “Elastic File System (EFS)” service.
- Select the EFS File System: From the list of EFS file systems, select the EFS file system that you want to enable recovery points for by clicking on its name.
- Enable Automatic Backups: In the EFS file system details page, click on the “Lifecycle management” tab.
- Edit Lifecycle Policy: Under the “Lifecycle policies” section, click on the “Edit” button.
- Enable Automatic Backups: In the “Edit lifecycle policy” window, check the box next to “Enable automatic backups” to enable automatic backups for the EFS file system.
- Configure Backup Retention: Set the desired backup retention period by entering the number of days you want to retain backups in the “Backup retention (days)” field.
- Save Changes: Click on the “Save” button to save the changes and enable automatic backups for the EFS file system.
- Verify Configuration: Once the changes are saved, verify that automatic backups are enabled for the EFS file system by checking the “Lifecycle policies” section in the EFS file system details page.
Using CLI
Using CLI
To remediate the misconfiguration of Elastic File System (EFS) not having a Recovery Point in AWS, you can follow these steps using AWS CLI:
-
Create a Backup Policy:
- Run the following AWS CLI command to create a backup policy for your EFS file system:
- Replace
<your-file-system-id>with the actual ID of your EFS file system. - This command will enable automatic backups for your EFS file system with a retention period of 7 days.
- Run the following AWS CLI command to create a backup policy for your EFS file system:
-
Verify Backup Policy:
- To verify that the backup policy has been successfully applied, you can run the following command:
- This command will display the backup policy details for your EFS file system.
- To verify that the backup policy has been successfully applied, you can run the following command:
Using Python
Using Python
To remediate the misconfiguration of an Elastic File System (EFS) not having a recovery point in AWS EC2 using Python, you can use the AWS SDK for Python (Boto3) to create a backup of the EFS file system. Here’s a step-by-step guide on how to do this:
- Install the Boto3 library if you haven’t already:
- Configure your AWS credentials either by setting environment variables or using the AWS CLI:
- Create a Python script with the following code to create a backup of the EFS file system:
- Run the Python script to create a backup of the EFS file system. Make sure to replace the
regionandefs_idvariables with your actual values.
Using Terraform
Using Terraform
Terraform cannot start a one-time AWS Backup job (
aws backup start-backup-job); there is no Terraform resource that maps to that imperative API, so you cannot create a single on‑demand EFS recovery point with Terraform.To match the verified remediation you must use the AWS CLI or Console steps you already have; Terraform can only be used for ongoing backup configuration (e.g., aws_backup_plan + aws_backup_selection), not the specific one-time recovery point this finding requires.
