​
Event Information

  • The ModifyMountTargetSecurityGroups event in AWS for EFS refers to a change in the security groups associated with a specific mount target in the Elastic File System (EFS) service.
  • This event occurs when there is a modification in the security group rules that control inbound and outbound traffic to the EFS mount target.
  • It indicates that the network access permissions for the EFS mount target have been updated, allowing or restricting traffic from specific sources or to specific destinations.

​
Examples

  • Unauthorized access: Modifying the security groups associated with an EFS mount target can potentially allow unauthorized access to the file system. If the security groups are not properly configured, it may allow malicious actors to gain access to sensitive data stored in the EFS file system.

  • Network vulnerabilities: Changing the security groups for an EFS mount target can introduce network vulnerabilities. If the new security groups do not have proper ingress and egress rules defined, it may expose the EFS file system to unauthorized network traffic, increasing the risk of attacks such as denial of service or data exfiltration.

  • Compliance violations: Modifying the security groups associated with an EFS mount target without considering compliance requirements can lead to violations. If the new security groups do not align with the organization’s compliance standards, it may result in non-compliance with regulations such as GDPR or HIPAA, leading to potential legal and financial consequences.

​
Remediation

​
Using Console

To remediate the issues mentioned in the previous response for AWS EFS using the AWS console, you can follow these step-by-step instructions:

  1. Enable encryption at rest for AWS EFS:

    • Open the AWS Management Console and navigate to the Amazon EFS service.
    • Select the EFS file system that needs to be encrypted.
    • Click on the “Actions” button and choose “Modify”.
    • Under the “Encryption at Rest” section, select the option to enable encryption.
    • Choose the appropriate AWS Key Management Service (KMS) key or create a new one.
    • Click on “Save” to apply the changes.

  2. Enable VPC endpoint for AWS EFS:

    • Open the AWS Management Console and go to the Amazon VPC service.
    • Select the VPC in which the EFS file system is located.
    • Click on “Endpoints” in the left navigation pane and then click on “Create Endpoint”.
    • Choose the service name as “com.amazonaws.<region>.elasticfilesystem” and select the appropriate VPC and subnets.
    • Configure the security groups and policies as per your requirements.
    • Click on “Create Endpoint” to create the VPC endpoint.

  3. Enable access logging for AWS EFS:

    • Open the AWS Management Console and navigate to the Amazon EFS service.
    • Select the EFS file system for which you want to enable access logging.
    • Click on the “Actions” button and choose “Modify”.
    • Under the “Access Logging” section, select the option to enable access logging.
    • Choose the appropriate Amazon CloudWatch log group to store the access logs.
    • Click on “Save” to apply the changes.

These steps will help you remediate the mentioned issues for AWS EFS using the AWS console.

​
Using CLI

To remediate the issues mentioned in the previous response for AWS EFS using AWS CLI, you can follow these steps:

  1. Enable encryption at rest for EFS:

    • Use the describe-file-systems command to get the details of the EFS file system: 
      aws efs describe-file-systems --file-system-id <file-system-id>
    • If encryption is not enabled, create a new EFS file system with encryption enabled using the create-file-system command: 
      aws efs create-file-system --encrypted --performance-mode generalPurpose
    • Migrate your data to the new encrypted EFS file system and update your applications to use the new file system.

  2. Enable VPC endpoint for EFS:

    • Use the describe-vpc-endpoints command to check if there is an existing VPC endpoint for EFS: 
      aws ec2 describe-vpc-endpoints --filters "Name=service-name,Values=com.amazonaws.<region>.elasticfilesystem" --query "VpcEndpoints[].VpcEndpointId"
    • If there is no VPC endpoint, create a new VPC endpoint for EFS using the create-vpc-endpoint command: 
      aws ec2 create-vpc-endpoint --vpc-id <vpc-id> --service-name com.amazonaws.<region>.elasticfilesystem --vpc-endpoint-type Gateway

  3. Enable VPC flow logs for EFS:

    • Use the describe-flow-logs command to check if there are existing VPC flow logs for the VPC: 
      aws ec2 describe-flow-logs --filter "Name=resource-id,Values=<vpc-id>"
    • If there are no VPC flow logs, create a new flow log for the VPC using the create-flow-logs command: 
      aws ec2 create-flow-logs --resource-ids <vpc-id> --resource-type VPC --traffic-type ALL --log-destination-type cloud-watch-logs --log-group-name <log-group-name>

Note: Replace <file-system-id>, <vpc-id>, and <log-group-name> with the appropriate values specific to your AWS environment.

​
Using Python

To remediate the issues mentioned in the previous response for AWS EFS using Python, you can use the following approaches:

  1. Enable encryption at rest:

    • Use the AWS SDK for Python (Boto3) to create a new EFS file system with encryption enabled.
    • Set the Encrypted parameter to True while creating the file system.
    • Here’s an example script:
    import boto3

efs_client = boto3.client('efs')

response = efs_client.create_file_system(
    CreationToken='my-token',
    PerformanceMode='generalPurpose',
    Encrypted=True
)

print(response)

  2. Enable VPC endpoint access:

    • Use Boto3 to modify the EFS mount target security groups to allow access from the VPC endpoint.
    • Set the SecurityGroups parameter of the modify_mount_target_security_groups method to include the security group associated with the VPC endpoint.
    • Here’s an example script:
    import boto3

efs_client = boto3.client('efs')

response = efs_client.modify_mount_target_security_groups(
    MountTargetId='mount-target-id',
    SecurityGroups=['security-group-id']
)

print(response)

  3. Enable access logging:

    • Use Boto3 to enable access logging for the EFS file system.
    • Set the LoggingConfiguration parameter of the update_file_system method to specify the desired logging settings.
    • Here’s an example script:
    import boto3

efs_client = boto3.client('efs')

response = efs_client.update_file_system(
    FileSystemId='file-system-id',
    LoggingConfiguration={
        'Enabled': True,
        'FileAccessLogDestination': 'arn:aws:s3:::my-bucket',
        'FileAccessLogFormat': 'csv'
    }
)

print(response)

Please note that you need to replace the placeholder values (e.g., my-token, mount-target-id, security-group-id, file-system-id, my-bucket) with the actual values specific to your AWS environment.