Description

Detects when AWS EFS (Elastic File System) resources are configured without encryption in CloudFormation templates. Unencrypted EFS filesystems can expose sensitive data since the contents are stored in plaintext, violating data protection requirements.

Detection Strategy

• Scans CloudFormation template files for AWS::EFS::FileSystem resource declarations

• Checks if encryption configuration is missing or disabled in the EFS resource properties

• Reports a vulnerability when an EFS filesystem is found without encryption enabled

Vulnerable code example

Resources:
  MyEFSFileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      AvailabilityZoneName: us-east-1a
      BackupPolicy:
        Status: ENABLED
      Encrypted: false  # Vulnerable: EFS should be encrypted at rest...

✅ Secure code example

Resources:
  MyEFSFileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      AvailabilityZoneName: us-east-1a
      BackupPolicy:
        Status: ENABLED
      Encrypted: true  # Required: Enable encryption at rest for data security...