EFS Encryption at Rest Not Enabled? Find Unencrypted File Systems

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonTlsClients",
      "Effect": "Deny",
      "Principal": { "AWS": "*" },
      "Action": "*",
      "Resource": "arn:aws:elasticfilesystem:us-east-1:111122223333:file-system/fs-0d4e5f6a7b8c9d0e1",
      "Condition": { "Bool": { "aws:SecureTransport": "false" } }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadEfs",
      "Effect": "Allow",
      "Action": [
        "elasticfilesystem:DescribeFileSystems",
        "elasticfilesystem:DescribeFileSystemPolicy",
        "elasticfilesystem:DescribeReplicationConfigurations"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadKeyType",
      "Effect": "Allow",
      "Action": "kms:DescribeKey",
      "Resource": "*"
    }
  ]
}

// find-unencrypted-efs-file-systems.ts
// Lists EFS file systems in one or more Regions and reports encryption at rest (and which kind of KMS key),
// whether the file system policy denies connections without TLS, and any replication already set up.
// Report only: EFS can't turn on encryption for an existing file system, so this script changes nothing.
// Usage:
//   npx tsx find-unencrypted-efs-file-systems.ts [--regions us-east-1,eu-west-1] [--only-problems]
import {
  DescribeFileSystemPolicyCommand,
  EFSClient,
  paginateDescribeFileSystems,
  paginateDescribeReplicationConfigurations,
} from "@aws-sdk/client-efs";
import { DescribeKeyCommand, KMSClient } from "@aws-sdk/client-kms";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1")
  .split(",")
  .map((r) => r.trim())
  .filter(Boolean);
const onlyProblems = args.includes("--only-problems");

interface Row {
  Region: string;
  FileSystem: string;
  Name: string;
  SizeGiB: number;
  AtRest: string;
  TlsRequired: string;
  Replica: string;
  Action: string;
}

const errName = (err: unknown): string => (err instanceof Error ? err.name : String(err));

// "AWS" for the AWS managed key aws/elasticfilesystem, "CUSTOMER" for your own key.
async function keyManager(kms: KMSClient, keyId: string): Promise<string> {
  try {
    const { KeyMetadata } = await kms.send(new DescribeKeyCommand({ KeyId: keyId }));
    return KeyMetadata?.KeyManager ?? "unknown";
  } catch (err) {
    return `unknown (${errName(err)})`;
  }
}

// True when a Deny statement matches aws:SecureTransport = false, which blocks non-TLS NFS clients.
function deniesInsecureTransport(policyJson: string): boolean {
  const doc = JSON.parse(policyJson) as { Statement?: unknown };
  const statements = Array.isArray(doc.Statement) ? doc.Statement : [doc.Statement];
  return statements.some((s) => {
    const st = s as { Effect?: string; Condition?: Record<string, Record<string, unknown>> };
    const value = st.Condition?.Bool?.["aws:SecureTransport"];
    return st.Effect === "Deny" && String(value).toLowerCase() === "false";
  });
}

async function tlsPolicy(efs: EFSClient, fileSystemId: string): Promise<string> {
  try {
    const { Policy } = await efs.send(new DescribeFileSystemPolicyCommand({ FileSystemId: fileSystemId }));
    return Policy && deniesInsecureTransport(Policy) ? "yes" : "no (policy has no TLS deny)";
  } catch (err) {
    if (errName(err) === "PolicyNotFound") return "no (default policy)";
    return `unknown (${errName(err)})`;
  }
}

async function scanRegion(region: string): Promise<Row[]> {
  const efs = new EFSClient({ region });
  const kms = new KMSClient({ region });

  // Map each source file system to its replication destinations (Region/ID/status).
  const replicas = new Map<string, string>();
  for await (const page of paginateDescribeReplicationConfigurations({ client: efs }, {})) {
    for (const rc of page.Replications ?? []) {
      const dest = (rc.Destinations ?? []).map((d) => `${d.Region}/${d.FileSystemId} (${d.Status})`).join(", ");
      if (rc.SourceFileSystemId) replicas.set(rc.SourceFileSystemId, dest);
    }
  }

  const rows: Row[] = [];
  for await (const page of paginateDescribeFileSystems({ client: efs }, {})) {
    for (const fs of page.FileSystems ?? []) {
      if (!fs.FileSystemId) continue;
      let atRest = "NOT ENCRYPTED";
      if (fs.Encrypted && fs.KmsKeyId) {
        const manager = await keyManager(kms, fs.KmsKeyId);
        atRest = manager === "AWS" ? "aws/elasticfilesystem" : manager === "CUSTOMER" ? "customer managed key" : manager;
      } else if (fs.Encrypted) {
        atRest = "encrypted";
      }
      const tls = await tlsPolicy(efs, fs.FileSystemId);
      const replica = replicas.get(fs.FileSystemId) ?? "-";
      let action = "ok";
      if (!fs.Encrypted) action = replica === "-" ? "migrate to an encrypted file system" : "migration in progress";
      else if (!tls.startsWith("yes")) action = "add a TLS-only file system policy";
      rows.push({
        Region: region,
        FileSystem: fs.FileSystemId,
        Name: fs.Name ?? "",
        SizeGiB: Math.round(((fs.SizeInBytes?.Value ?? 0) / 1024 ** 3) * 10) / 10,
        AtRest: atRest,
        TlsRequired: tls,
        Replica: replica,
        Action: action,
      });
    }
  }
  return rows;
}

async function main(): Promise<void> {
  const all: Row[] = [];
  for (const region of regions) all.push(...(await scanRegion(region)));
  const shown = onlyProblems ? all.filter((r) => r.Action !== "ok") : all;
  const unencrypted = all.filter((r) => r.AtRest === "NOT ENCRYPTED").length;
  console.log(`EFS file systems: ${all.length} in ${regions.join(", ")}; without encryption at rest: ${unencrypted}`);
  if (shown.length) console.table(shown);
  console.log("Report only. Encryption at rest can't be enabled on an existing EFS file system.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-efs @aws-sdk/client-kms
npm install --save-dev tsx typescript @types/node

# One Region from your profile or AWS_REGION
AWS_PROFILE=audit npx tsx find-unencrypted-efs-file-systems.ts

# Several Regions, only rows that need action
AWS_PROFILE=audit npx tsx find-unencrypted-efs-file-systems.ts --regions us-east-1,eu-west-1 --only-problems

EFS file systems: 4 in us-east-1; without encryption at rest: 2
┌─────────┬─────────────┬────────────────────────┬───────────────┬─────────┬─────────────────────────┬───────────────────────┬────────────────────────────────────────────┬───────────────────────────────────────┐
│ (index) │ Region      │ FileSystem             │ Name          │ SizeGiB │ AtRest                  │ TlsRequired           │ Replica                                    │ Action                                │
├─────────┼─────────────┼────────────────────────┼───────────────┼─────────┼─────────────────────────┼───────────────────────┼────────────────────────────────────────────┼───────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'fs-0a1b2c3d4e5f60718' │ 'cms-uploads' │ 212.4   │ 'NOT ENCRYPTED'         │ 'no (default policy)' │ '-'                                        │ 'migrate to an encrypted file system' │
│ 1       │ 'us-east-1' │ 'fs-07c9e1d2b3a4f5061' │ 'build-cache' │ 38.2    │ 'NOT ENCRYPTED'         │ 'no (default policy)' │ 'us-east-1/fs-0e8d7c6b5a4f3e2d1 (ENABLED)' │ 'migration in progress'               │
│ 2       │ 'us-east-1' │ 'fs-0d4e5f6a7b8c9d0e1' │ 'wp-content'  │ 9.7     │ 'aws/elasticfilesystem' │ 'no (default policy)' │ '-'                                        │ 'add a TLS-only file system policy'   │
│ 3       │ 'us-east-1' │ 'fs-02b3c4d5e6f7a8b9c' │ 'ml-datasets' │ 1843    │ 'customer managed key'  │ 'yes'                 │ '-'                                        │ 'ok'                                  │
└─────────┴─────────────┴────────────────────────┴───────────────┴─────────┴─────────────────────────┴───────────────────────┴────────────────────────────────────────────┴───────────────────────────────────────┘
Report only. Encryption at rest can't be enabled on an existing EFS file system.