Cis AWS Storage 3.9

3.9 Ensure using VPC endpoints - EFS (Manual)

Profile Applicability

• Level 2

Description

With AWS PrivateLink, VPC Endpoints allow services to communicate within AWS using private IP addresses within approved CIDR ranges. This communication can be achieved without the need for a VPN, ensuring secure and efficient data transfer.

Rationale

The rationale behind using AWS PrivateLink with VPC Endpoints is to enable secure and efficient communication between services within AWS. By using private IP addresses within approved CIDR ranges, it eliminates the need for a VPN, reducing complexity and potential points of failure. This approach enhances security, reduces latency, and ensures data remains within the AWS network, aligning with best practices for secure and reliable cloud architecture.

Impact

Not using AWS PrivateLink with VPC Endpoints can lead to several issues, including increased security risks and potential data exposure since services would need to communicate over the public internet or through more complex VPN setups. This can result in higher latency, reduced performance, and greater vulnerability to attacks. Additionally, managing VPN connections adds complexity and potential points of failure, compromising the overall efficiency and reliability of your network architecture.

Audit Procedure

Console

Creating a FIPS compliant interface endpoint for EFS:

1. Navigate to VPC Console: https://console.aws.amazon.com/vpc/
2. Select "Endpoints" on the sidebar.
3. Select "Create endpoint".
4. Name the endpoint.
5. Copy and paste this services into the services bar: com.amazonaws.region.elasticfilesystem-fips – replace "region: with us-east-1 or whatever region you're using.
6. Select your VPC.
7. For subnets, select the availability zone and then select private subnet.
8. Select the Security Group for the VPC endpoint.
9. For policy: select "full access".
10. Create a tag for future reference / granular IAM permissions.
11. Create endpoint.

Expected Result

• VPC endpoint should be created for EFS service
• Endpoint should use FIPS-compliant service name
• Endpoint should be associated with appropriate VPC and subnets
• Security group should be configured for the endpoint
• Full access policy should be configured (or restricted as per requirements)

Remediation

Console

Use VPC Endpoints in tandem with AWS Private Link to secure your EFS connections.

1. Navigate to VPC Console
2. Create VPC endpoint for EFS
3. Configure endpoint with appropriate VPC, subnets, and security groups
4. Use FIPS-compliant service endpoint: com.amazonaws.[region].elasticfilesystem-fips
5. Configure access policy as needed

Default Value

VPC endpoints are not created by default. Users must explicitly create and configure VPC endpoints for EFS to enable private connectivity.

References

1. https://docs.aws.amazon.com/efs/latest/ug/efs-vpc-endpoints.html#:~:text=To%20establish%20a%20private%20connection,private%20network%20(VPN)%20connection.

CIS Controls

Profile

Level 2