Review the EFS customer managed KMS key

Description

An encrypted EFS file system can use an AWS managed key when kms_key_id is omitted. This is different from unencrypted storage, but may not meet requirements for direct control of the key policy and lifecycle through a customer managed key.

Review the sensitivity of shared files and your key-management requirements. File permissions and network access still need controls separate from encryption at rest.

Potential impact

Unmet customer-key requirements can weaken audit and operational controls. Disabling or deleting a key in use can also interrupt file access.

Remediation

Set encrypted = true for a new file system and specify a required customer managed key through kms_key_id. Verify the key is in the same Region and has the required permissions.
An existing file system’s KMS key cannot be changed. Review Terraform’s replacement plan, migrate data to a new file system, then switch mounts and applications.
Verify key policies, file permissions and normal reads and writes. Preserve the source data during migration.

Examples

These compare key selection for a new file system. Replace the example key ID with a usable customer managed key.

Before

hcl

resource "aws_efs_file_system" "example" {
  creation_token = "my-product"
  encrypted      = true
}

Encryption is enabled without specifying a customer managed key.

After

hcl

resource "aws_efs_file_system" "example" {
  creation_token = "my-product"
  encrypted      = true
  kms_key_id     = "1234abcd-12ab-34cd-56ef-1234567890ab"
}

This specifies a customer managed key. Applying it to an existing file system requires replacement, so review the data migration plan first.