cis-aws-storage-3.11

3.11 Ensure accessing Points and IAM Policies (Manual)

Profile Applicability

• Level 2

Description

You can use IAM policies to control access to your EFS access points. To achieve this, utilize the elasticfilesystem:AccessPointArn IAM condition key. The AccessPointArn represents the Amazon Resource Name (ARN) of the access point that the file system is mounted with.

Rationale

The rationale for using IAM policies with the elasticfilesystem:AccessPointArn condition key is to ensure precise and secure access control to EFS access points. By specifying the access point's ARN, you can restrict interactions to authorized users and resources only, thereby enhancing data security and preventing unauthorized access. This approach maintains the integrity and confidentiality of your data within the AWS environment.

Impact

Without using IAM policies with the elasticfilesystem:AccessPointArn condition key, access control to EFS access points becomes less precise, increasing the risk of unauthorized access. This lack of granular control can lead to potential security breaches, data exposure, and compliance violations. Consequently, your organization may face data integrity issues, financial losses, and damage to its reputation.

Audit Procedure

Console

Below is a sample IAM policy copied from the AWS documentation:

{
  "Version": "2012-10-17",
  "Id": "MyFileSystemPolicy",
  "Statement": [
    {
      "Sid": "App1Access",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:role/app1" },
      "Action": ["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite"],
      "Condition": {
        "StringEquals": {
          "elasticfilesystem:AccessPointArn": "arn:aws:elasticfilesystem:us-east-1:222233334444:access-point/fsap-01234567"
        }
      }
    },
    {
      "Sid": "App2Access",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:role/app2" },
      "Action": ["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite"],
      "Condition": {
        "StringEquals": {
          "elasticfilesystem:AccessPointArn": "arn:aws:elasticfilesystem:us-east-1:222233334444:access-point/fsap-89abcdef"
        }
      }
    }
  ]
}

This policy demonstrates:

• Using the elasticfilesystem:AccessPointArn condition to restrict access to specific access points
• Granting ClientMount and ClientWrite permissions to specific IAM roles
• Associating different roles with different access points

Expected Result

• IAM policies should use the elasticfilesystem:AccessPointArn condition key
• Policies should restrict access to specific access points via their ARN
• Only authorized principals should have ClientMount and ClientWrite permissions
• Each access point should have appropriate IAM policy restrictions

Remediation

Console

Implement IAM policies that use the elasticfilesystem:AccessPointArn condition key:

1. Create or update IAM policies for EFS access
2. Include the elasticfilesystem:AccessPointArn condition key
3. Specify the ARN of the access point in the condition
4. Grant only necessary permissions (ClientMount, ClientWrite, etc.)
5. Assign policies to appropriate IAM roles/users
6. Review and test access control regularly

Example policy structure:

{
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::ACCOUNT:role/ROLE" },
  "Action": ["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite"],
  "Condition": {
    "StringEquals": {
      "elasticfilesystem:AccessPointArn": "arn:aws:elasticfilesystem:REGION:ACCOUNT:access-point/ACCESS_POINT_ID"
    }
  }
}

Default Value

By default, no IAM policies are automatically created for EFS access points. Users must explicitly create and configure IAM policies with appropriate condition keys to control access.

References

1. https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html

CIS Controls

Profile

Level 2