Terraform AWS EFS

Amazon EFS file systems with mount targets, access points, backup policies, lifecycle management, encryption at rest, and security group controlled NFS access.

Quick start

module "efs" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "efs" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "efs" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "efs" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "efs" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "efs" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "efs" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "efs" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "efs" {
  source  = "terraform-aws-modules/efs/aws"
  version = "~> 2.2"
}

module "efs" {
  source  = "soc2.compliance.tf/terraform-aws-modules/efs/aws"
  version = "~> 2.2"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "efs" {
  source  = "terraform-aws-modules/efs/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 5 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
EFS access points should enforce a root directory	Low
EFS file systems should have encryption at rest enabled	Low
EFS file systems should be encrypted with CMK	Low
VPC Security groups should only allow unrestricted incoming traffic for authorized ports	Low
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	Low

Mapped compliance frameworks

Clause	Controls from this module
1.3.1: Network access to and from the cardholder data environment is restricted.	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
1.3.2: Network access to and from the cardholder data environment is restricted.	VPC Security groups should only allow unrestricted incoming traffic for authorized ports
10.3.2: Audit logs are protected from destruction and unauthorized modifications.	EFS access points should enforce a root directory
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.	EFS access points should enforce a root directory
3.5.1: Primary account number (PAN) is secured wherever it is stored.	EFS file systems should have encryption at rest enabled
8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components	EFS file systems should have encryption at rest enabled
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.	EFS access points should enforce a root directory
A3.4.1: Logical access to the cardholder data environment is controlled and managed.	EFS access points should enforce a root directory

Clause	Controls from this module
AC-4: Information Flow Enforcement	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
Protection of Information at Rest (SC-28)	EFS file systems should have encryption at rest enabled
SC-7: Boundary Protection	VPC Security groups should only allow unrestricted incoming traffic for authorized ports

Clause	Controls from this module
3.1.3: Control the flow of CUI in accordance with approved authorizations.	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
3.13.11 Employ FIPS-validated cryptography when used to protect the confidentiality of CUI	EFS file systems should have encryption at rest enabled
3.13.16: Protect the confidentiality of CUI at rest.	EFS file systems should have encryption at rest enabled
3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.	VPC Security groups should only allow unrestricted incoming traffic for authorized ports

Clause	Controls from this module
AU-9(3) Cryptographic Protection	EFS file systems should have encryption at rest enabled
CP-9(d)	EFS file systems should have encryption at rest enabled
SC-13(a)	EFS file systems should have encryption at rest enabled
SC-28(1): Cryptographic Protection	EFS file systems should have encryption at rest enabled
SC-7(13): Isolation Of Security Tools, Mechanisms, And Support Components	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
SC-7: Boundary Protection	VPC Security groups should only allow unrestricted incoming traffic for authorized ports
SC-8(3) Cryptographic Protection For Message Externals	EFS file systems should have encryption at rest enabled
SC-8(4) Conceal Or Ramdomize Communications	EFS file systems should have encryption at rest enabled
SI-19(4) Removal, Masking, Encryption, Hashing, Or Replacement Of Direct Identifiers	EFS file systems should have encryption at rest enabled

Clause	Controls from this module
Data protection	EFS file systems should have encryption at rest enabled

Clause	Controls from this module
11.10(d) Limiting system access to authorized individuals	VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
11.10(g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand	EFS file systems should have encryption at rest enabled
11.30 Controls for open systems	EFS file systems should have encryption at rest enabled

Clause	Controls from this module
12.1 Security	VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
7.1 Data Storage - Damage Protection	EFS file systems should have encryption at rest enabled

Clause	Controls from this module
A.8.24 Use of cryptography	EFS file systems should have encryption at rest enabled

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	PCI DSS v4.0
EFS access points should enforce a root directory	Enforced
EFS file systems should have encryption at rest enabled	Enforced
EFS file systems should be encrypted with CMK	Not active
VPC Security groups should only allow unrestricted incoming traffic for authorized ports	Enforced
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	Enforced

5 controls enforced with a source URL change.

Start free trial Get started