EFS Access Points User Identity Should Be Enforced

​

More Info:

This rule checks if Amazon Elastic File System (Amazon EFS) access points are configured to enforce a user identity. It is marked as non-compliant if ‘PosixUser’ is not defined or if parameters are provided and there is no match in the corresponding parameter.

​

Risk Level

High

​

Address

Security

​

Compliance Standards

CBP,RBI_MD_ITF

​

Remediation

​

Using Console

To remediate the misconfiguration of EFS Access Points User Identity not being enforced in AWS Kubernetes using the AWS console, you can follow these step-by-step instructions:

1. Login to AWS Console: Go to the AWS Management Console and login with your credentials.

2. Navigate to Amazon EFS service: Click on “Services” in the top menu bar, search for “EFS” in the search bar, and click on “Amazon EFS” to open the EFS dashboard.

3. Select the EFS File System: From the list of available EFS file systems, select the EFS file system for which you want to enforce user identity for access points.

4. Create Access Points: If you haven’t already created an access point for the EFS file system, you will need to create one. Click on the “Access points” tab in the EFS dashboard, then click on the “Create access point” button.

5. Configure Access Point: Fill in the necessary details for the access point, such as the name, root directory path, owner UID, owner GID, and POSIX permissions. Ensure that you specify the correct owner UID and owner GID to enforce user identity.

6. Enable User Identity Enforcement: In the access point configuration, make sure to select the option to “Enforce user identity” to ensure that the user identity is enforced for the access point.

7. Save Changes: Once you have configured the access point with the necessary details and enabled user identity enforcement, click on the “Create access point” button to save the changes.

8. Update Kubernetes Configurations: Update your Kubernetes configurations to use the newly created EFS access point with user identity enforcement enabled. You may need to update your PersistentVolumeClaims (PVCs) and PersistentVolumes (PVs) to use the access point.

By following these steps, you can remediate the misconfiguration of EFS Access Points User Identity not being enforced in AWS Kubernetes using the AWS console.

​

Using CLI

To remediate the misconfiguration of EFS Access Points User Identity not being enforced in AWS Kubernetes using AWS CLI, follow these steps:

1. Identify the EFS Access Points that need to enforce User Identity:

   • List all the EFS Access Points in your AWS account using the following AWS CLI command:

     aws efs describe-access-points
     

2. Update the EFS Access Points to enforce User Identity:

   • For each EFS Access Point identified in step 1, update the access point to enforce user identity using the following AWS CLI command:

     aws efs update-access-point --access-point-id <access-point-id> --posix-user "Uid=1000,Gid=1000"
     

     Replace <access-point-id> with the actual ID of the EFS Access Point that needs to enforce user identity. Replace Uid=1000,Gid=1000 with the appropriate POSIX user identity that you want to enforce.

3. Verify the changes:

   • After updating the EFS Access Points, verify that the user identity enforcement is in place by describing the access point again using the following AWS CLI command:

     aws efs describe-access-points --access-point-id <access-point-id>
     

     Ensure that the PosixUser field reflects the updated user identity settings.

By following these steps, you can remediate the misconfiguration of EFS Access Points User Identity not being enforced in AWS Kubernetes using AWS CLI.

​

Using Python

To remediate the misconfiguration of EFS Access Points user identity not being enforced in AWS Kubernetes using Python, you can follow these steps:

1. Install the necessary Python libraries:

   pip install boto3
   

2. Use the following Python script to enforce user identity for EFS Access Points in AWS:

   import boto3
   
   # Initialize the EFS client
   efs_client = boto3.client('efs')
   
   # Get a list of all EFS Access Points
   access_points = efs_client.describe_access_points()
   
   # Loop through each Access Point and update the policy to enforce user identity
   for access_point in access_points['AccessPoints']:
       access_point_id = access_point['AccessPointId']
       access_point_policy = {
           "Path": "/*",
           "PosixUser": {
               "Uid": "required",
               "Gid": "required"
           }
       }
       efs_client.put_access_point_policy(AccessPointId=access_point_id, Policy=access_point_policy)
   
   print("User identity enforcement for EFS Access Points has been successfully updated.")
   

3. Run the Python script to enforce user identity for all EFS Access Points in your AWS account.

By following these steps, you can remediate the misconfiguration of EFS Access Points user identity not being enforced in AWS Kubernetes using Python.