> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Efs encryption enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the EFS Encryption Enabled misconfiguration in AWS, you can follow the below steps:

        1. Open the AWS Management Console and navigate to the Amazon Elastic File System (EFS) service.

        2. Select the EFS file system that needs to be remediated.

        3. Click on the "Actions" button and select "Modify file system".

        4. In the "Modify file system" window, scroll down to the "Encryption" section.

        5. Disable the encryption by selecting "No" for the "Encrypt file system" option.

        6. Click on the "Modify" button to save the changes.

        7. Once the changes are saved, the EFS file system will be unencrypted.

        Note: If you need to encrypt the EFS file system, you can follow the same steps and select "Yes" for the "Encrypt file system" option in step 5.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of EFS Encryption Enabled in AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to get a list of all the EFS file systems in your AWS account:

        ```
        aws efs describe-file-systems
        ```

        3. Identify the EFS file system that has encryption disabled.

        4. Run the following command to enable encryption for the identified EFS file system:

        ```
        aws efs update-file-system --file-system-id <file-system-id> --encrypted
        ```

        Replace `<file-system-id>` with the ID of the EFS file system that you want to enable encryption for.

        5. Verify that encryption is enabled for the EFS file system by running the following command:

        ```
        aws efs describe-file-systems --file-system-id <file-system-id> --query "FileSystems[*].Encrypted"
        ```

        Replace `<file-system-id>` with the ID of the EFS file system that you enabled encryption for.

        6. Repeat the above steps for all the EFS file systems in your AWS account that have encryption disabled.

        By following these steps, you can remediate the misconfiguration of EFS Encryption Enabled in AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the EFS Encryption Enabled misconfiguration in AWS using Python, follow these steps:

        1. Open the AWS console and navigate to the EFS service.
        2. Select the EFS file system that has encryption enabled.
        3. Click on the “Modify” button in the top menu bar.
        4. Scroll down to the “Encryption” section and select “No” in the “Encryption” dropdown menu.
        5. Click on the “Save” button to disable encryption for the EFS file system.

        To do this programmatically using Python, you can use the AWS SDK for Python (Boto3) to modify the encryption setting for the EFS file system. Here's an example code snippet to disable encryption for an EFS file system:

        ```
        import boto3

        # Create an EFS client
        efs = boto3.client('efs')

        # Set the EFS file system ID
        file_system_id = 'fs-12345678'

        # Disable encryption for the EFS file system
        response = efs.modify_file_system(
            FileSystemId=file_system_id,
            Encrypted=False
        )

        # Print the response
        print(response)
        ```

        Make sure to replace `fs-12345678` with the actual ID of the EFS file system that you want to remediate.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_efs_file_system" "THIS_FILE_SYSTEM" {
          # Replace THIS_FILE_SYSTEM with a meaningful name or keep as-is if matching an existing resource
          creation_token = "UNIQUE_CREATION_TOKEN_FOR_THIS_FS" # replace with a stable unique string

          # This is the setting that fixes the finding:
          encrypted  = true
          kms_key_id = aws_kms_key.EFS_KMS_KEY.arn # or "arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID"

          performance_mode = "generalPurpose"

          tags = {
            Name = "EFS_ENCRYPTED_FS_NAME" # replace with your file system name
          }
        }

        resource "aws_kms_key" "EFS_KMS_KEY" {
          description             = "KMS key for encrypting EFS file system"
          deletion_window_in_days = 30
          enable_key_rotation     = true

          tags = {
            Name = "efs-kms-key"
          }
        }
        ```

        Enabling or changing `encrypted`/`kms_key_id` on an existing `aws_efs_file_system` forces replacement of the file system, which deletes the old one and its data; plan carefully to avoid outage and data loss.

        To verify, `terraform plan` should show either:

        * creating a new `aws_efs_file_system` with `encrypted: "true"` and the desired `kms_key_id`, or
        * replacing the existing file system where the diff includes `encrypted: "false" => "true"` (and/or a change to `kms_key_id`) with `-/+` on the resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>