Description

Detects AWS Elastic File System (EFS) resources that are configured without encryption enabled. Unencrypted EFS filesystems can expose sensitive data at rest, failing to meet security best practices and compliance requirements for data protection.

Detection Strategy

• Identifies Terraform resource blocks defining 'aws_efs_file_system'

• Checks if encryption configuration is missing or disabled in the EFS resource definition

• Reports a vulnerability when an EFS filesystem is configured without encryption settings

Vulnerable code example

resource "aws_efs_file_system" "example" {
  creation_token = "my-efs"
  encrypted      = false  # Security risk: EFS is not encrypted at rest
}

✅ Secure code example

resource "aws_efs_file_system" "example" {
  creation_token = "my-efs"
  encrypted      = true         # Enable encryption at rest for data security
  kms_key_id     = aws_kms_key.efs_key.arn  # Use customer-managed KMS key for better control
}

# Define KMS key for EFS encryption
resource "aws_kms_key" "efs_key" {...