Steps to Reproduce

This issue concerns the efs_not_publicly_accessible check. The bug report concerns the validity / usefulness of the check itself, not its implementation.

Expected behavior

The (potential) problem

I don't understand the issue flagged by the efs_not_publicly_accessible check.

The check flags file systems that either

1. have no file system policy, or
2. that have a public file system policy with a principle as *.

It flags non-conforming resources with critical severity and suggests such resources are publicly accessible.

Accessing EFS resources

My understanding of EFS is as follows: file systems are only accessible through dedicated mount points or via AWS Transfer Family:

• Mount points: Mount points are dedicated resources that need to be created and assigned a VPC. Mount points can never have a public IP and are therefore never available over the Internet. Clients can only connect to and mount a file system if they have network access to the mount point, which is restricted to VPCs. With a public file system policy (or without a file system policy at all), EFS relies on UID / GID supplied by NFS clients. This is an inherent issue in NFS and not AWS specific. It has little to do with file system policies in AWS.

• AWS Transfer Family: For public EFS resources, no access via AWS Transfer Family is possible.

Searching online for more information regarding public EFS systems, I found

• this additional resource. It looks like it is based directly on Prowler's rule and provides no additional information.
• The related AWS documentation, which does not indicate direct security risks associated with "public" EFS resources and highlights primarily usability issues to keep in mind.
• This SO post supports my understanding from above.

So what?

Reading the rule's critical risk (EFS accessible to everyone could expose sensitive data to bad actors) suggests to me that public EFS resources are akin to publicly accessible S3 buckets. However, this is not the case, as access over the Internet is never possible.

Based on this,

1. the severity rating of critical seems too high to me, and
2. the risk statement is misleading and confusing.

From my understanding, the only bad actors that sensitive data could be exposed to are internal actors with preexisting access that abuse NFS protocol flaws, similar to users with overprivileged policy assignments.

I'd love to know more about this check and know what I might have gotten wrong above. Please let me know if your understanding differs here and what your reasoning is as to how public EFS file systems are accessible to everyone.

Actual Result with Screenshots or Logs

not relevant

How did you install Prowler?

Cloning the repository from github.com (git clone)

Environment Resource

not relevant

OS used

not relevant

Prowler version

Prowler 4.1.0 (You are running the latest version, yay!)

Pip version

pip 24.0

Context

No response