AWS Security Hub · EFS
EFS.6: Mount targets not in public-IP subnets
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub EFS.6 check?
EFS.6 inspects the subnet each EFS mount target lives in and checks the subnet's MapPublicIpOnLaunch attribute. It reports FAILED when a mount target sits in a subnet configured to assign public IPs.
Why does EFS.6 matter?
A mount target in a public-IP subnet widens the network attack surface of shared storage: resources in that subnet can carry public addresses, putting the file system closer to internet-reachable hosts than it should be. Keeping mount targets in private subnets keeps EFS strictly internal.
How do I fix EFS.6?
- Find every mount target and check its subnet's MapPublicIpOnLaunch with describe-mount-targets and describe-subnets.
- Because a mount target's subnet is immutable, create a new mount target in a private subnet.
- Repoint clients at the new mount target.
- Delete the old mount target in the public subnet.
Remediation script · bash
# Close the highest-impact public exposure first: databases.
for db in $(aws rds describe-db-instances \
--query 'DBInstances[?PubliclyAccessible==`true`].DBInstanceIdentifier' --output text); do
aws rds modify-db-instance --db-instance-identifier "$db" \
--no-publicly-accessible --apply-immediately
echo "$db: public access removed"
done
# Ratchet S3 shut at the account level so no bucket can be made public again.
aws s3control put-public-access-block --account-id 123456789012 \
--public-access-block-configuration \
'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'Full walkthrough (console steps, edge cases and verification) in the lesson Block public access to AWS resources.
Is EFS.6 a false positive?
You cannot move a mount target between subnets in place; fixing EFS.6 means create-new-then-delete-old, not an edit.