EFS.4: EFS access points should enforce a user identity

What does AWS Security Hub EFS.4 check?

EFS.4 checks that EFS access points enforce a POSIX user identity. It reports FAILED when an access point has no PosixUser (Uid, Gid and optional SecondaryGids), so it does not override the identity the NFS client claims.

Why does EFS.4 matter?

NFS trusts whatever Uid/Gid the client presents, which means a misconfigured or malicious client can impersonate any user on shared storage. An enforced PosixUser overrides the client-supplied identity, so every request runs as a fixed, known user regardless of what the client claims.

How do I fix EFS.4?

1. List access points and find those without a PosixUser using describe-access-points.
2. Because access points are immutable, create a replacement with an enforced PosixUser (Uid, Gid, optional SecondaryGids).
3. Repoint consumers at the new access point and delete the old one.
4. Add a Config rule or IaC default so new access points always set an identity.

# Find every access point with no enforced identity on a file system, then
# create a compliant replacement for one of them.
FS=fs-0a1b2c3d4e5f6a7b8

aws efs describe-access-points --file-system-id $FS \
  --query 'AccessPoints[?PosixUser==`null`].AccessPointId' \
  --output text

# Replacement with an enforced POSIX user (and a non-root directory for EFS.3).
aws efs create-access-point \
  --file-system-id $FS \
  --posix-user 'Uid=1000,Gid=1000,SecondaryGids=[1001,1002]' \
  --root-directory 'Path=/analytics,CreationInfo={OwnerUid=1000,OwnerGid=1000,Permissions=0750}' \
  --tags Key=Name,Value=analytics-shared-v2

# After repointing the application and confirming it works, delete the old one.
aws efs delete-access-point --access-point-id fsap-OLDID