​
Event Information

  • The CreateMountTarget event in AWS for EFS (Elastic File System) refers to the creation of a mount target for an EFS file system.
  • A mount target is a network interface that allows EC2 instances to connect to an EFS file system securely over the Amazon VPC (Virtual Private Cloud) network.
  • This event indicates that a new mount target has been successfully created, enabling EC2 instances within the specified VPC to access the EFS file system.

​
Examples

  • Unauthorized access: If proper access controls are not implemented, an attacker may be able to gain unauthorized access to the EFS file system through the CreateMountTarget API. This can lead to potential data breaches or unauthorized modifications to the file system.
  • Data leakage: If the CreateMountTarget API is misconfigured, it may result in unintended exposure of sensitive data stored in the EFS file system. This can occur if the mount target is created in a public subnet or if the security groups associated with the mount target allow unrestricted inbound access.
  • Denial of service: An attacker can potentially launch a denial of service (DoS) attack by repeatedly creating mount targets for an EFS file system. This can exhaust the available resources and impact the availability of the file system for legitimate users. Proper rate limiting and monitoring should be implemented to mitigate this risk.

​
Remediation

​
Using Console

  1. Enable encryption at rest for AWS EFS:
    • Open the AWS Management Console and navigate to the Amazon EFS service.
    • Select the EFS file system that needs to be remediated.
    • In the “Actions” dropdown menu, click on “Modify”.
    • Under the “Encryption at Rest” section, select the desired encryption option (AWS Key Management Service - KMS or AWS managed keys).
    • Click on “Save” to apply the encryption settings to the EFS file system.
  2. Enable VPC endpoint for AWS EFS:
    • Open the AWS Management Console and go to the Amazon VPC service.
    • Select the VPC in which the EFS file system is located.
    • Click on “Endpoints” in the left navigation pane.
    • Click on “Create Endpoint” and select “Amazon Elastic File System (EFS)” as the service category.
    • Choose the desired VPC and subnet for the endpoint.
    • Select the security groups that should be associated with the endpoint.
    • Click on “Create Endpoint” to create the VPC endpoint for EFS.
  3. Enable access logging for AWS EFS:
    • Open the AWS Management Console and navigate to the Amazon EFS service.
    • Select the EFS file system that needs to have access logging enabled.
    • In the “Actions” dropdown menu, click on “Modify”.
    • Under the “Access Logging” section, enable the access logging option.
    • Specify the S3 bucket where the access logs should be stored.
    • Click on “Save” to enable access logging for the EFS file system.

​
Using CLI

To remediate the issues mentioned in the previous response for AWS EFS using AWS CLI, you can follow these steps:
  1. Enable encryption at rest for EFS:
    • Use the describe-file-systems command to get the details of the EFS file system: 
      aws efs describe-file-systems --file-system-id <file-system-id>
    • If encryption is not enabled, use the update-file-system command to enable encryption at rest: 
      aws efs update-file-system --file-system-id <file-system-id> --encrypted
  2. Enable VPC endpoint for EFS:
    • Use the describe-vpc-endpoints command to check if there is an existing VPC endpoint for EFS: 
      aws ec2 describe-vpc-endpoints --filters "Name=service-name,Values=com.amazonaws.<region>.elasticfilesystem" --query "VpcEndpoints[].VpcEndpointId"
    • If no VPC endpoint exists, use the create-vpc-endpoint command to create a VPC endpoint for EFS: 
      aws ec2 create-vpc-endpoint --vpc-id <vpc-id> --service-name com.amazonaws.<region>.elasticfilesystem --subnet-ids <subnet-ids>
  3. Enable access logging for EFS:
    • Use the describe-file-systems command to get the details of the EFS file system: 
      aws efs describe-file-systems --file-system-id <file-system-id>
    • If access logging is not enabled, use the update-file-system command to enable access logging: 
      aws efs update-file-system --file-system-id <file-system-id> --logging-configuration '{"Enabled": true}'
Note: Replace <file-system-id>, <vpc-id>, and <subnet-ids> with the actual values specific to your AWS environment.

​
Using Python

To remediate the issues mentioned in the previous response for AWS EFS using Python, you can use the following approaches:
  1. Enable encryption at rest:
    • Use the AWS SDK for Python (Boto3) to create a new EFS file system with encryption enabled.
    • Set the Encrypted parameter to True while creating the file system.
    • Here’s an example script:
    import boto3

efs_client = boto3.client('efs')

response = efs_client.create_file_system(
    CreationToken='your-unique-token',
    PerformanceMode='generalPurpose',
    Encrypted=True
)

print(response)
  2. Enable VPC endpoint access:
    • Use Boto3 to modify the EFS mount target security groups to allow access from the VPC endpoint.
    • Set the SecurityGroups parameter of the modify_mount_target_security_groups method to include the security group associated with the VPC endpoint.
    • Here’s an example script:
    import boto3

efs_client = boto3.client('efs')

response = efs_client.modify_mount_target_security_groups(
    MountTargetId='your-mount-target-id',
    SecurityGroups=['your-security-group-id']
)

print(response)
  3. Enable access logging:
    • Use Boto3 to enable access logging for the EFS file system.
    • Set the LoggingConfiguration parameter of the update_file_system method to specify the desired logging settings.
    • Here’s an example script:
    import boto3

efs_client = boto3.client('efs')

response = efs_client.update_file_system(
    FileSystemId='your-file-system-id',
    LoggingConfiguration={
        'Enabled': True,
        'FileAccessLogDestination': 'your-log-destination',
        'FileAccessLogFormat': 'your-log-format'
    }
)

print(response)
Please note that you need to replace the placeholders (your-unique-token, your-mount-target-id, your-security-group-id, your-file-system-id, your-log-destination, your-log-format) with the actual values specific to your AWS environment.