Control: 4 EFS access points should enforce a user identity
Description
This control checks whether Amazon EFS access points are configured to enforce a user identity. This control fails if a POSIX user identity is not defined while creating the EFS access point.
Amazon EFS access points are application-specific entry points into an EFS file system that make it easier to manage application access to shared datasets. Access points can enforce a user identity, including the user's POSIX groups, for all file system requests that are made through the access point. Access points can also enforce a different root directory for the file system so that clients can only access data in the specified directory or its subdirectories.
Remediation
To enforce a user identity for an Amazon EFS access point, see Enforcing a user identity using an access point in the Amazon Elastic File System User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_efs_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_efs_4 --shareSQL
This control uses a named query:
select access_point_arn as resource, case when posix_user is null then 'alarm' else 'ok' end as status, case when posix_user is null then title || ' does not enforce a user identity.' else title || ' enforces a user identity.' end as reason , region, account_idfrom aws_efs_access_point;