cyberstrikeus 3.7 Ensure File-Level Access Control with Mount Targets (Manual)
Profile Applicability
- Level 2
Description
Mount targets act as gateways, enabling resources to be accessed across different availability zones within a VPC. When you create an EFS file system, mount targets are automatically provisioned in each availability zone associated with the VPC. This ensures high availability and redundancy, allowing seamless and efficient access to the EFS file system from any availability zone.
Rationale
Using mount targets ensures seamless access to the EFS file system across different availability zones within a VPC. This automatic provisioning of mount targets in each availability zone provides high availability and redundancy, essential for maintaining uninterrupted data access. It simplifies configuration and enhances the resilience and scalability of the file system architecture.
Impact
Not using mount targets can lead to inefficient and unreliable access to the EFS file system across availability zones. This lack of automatic provisioning reduces high availability and redundancy, increasing the risk of service interruptions and data access issues. Consequently, your infrastructure may suffer from decreased performance, higher latency, and potential data loss or downtime.
Audit Procedure
Console
Verify that mount targets are properly configured in each availability zone:
- Navigate to EFS console
- Select the file system
- Verify mount targets exist in each availability zone
- Ensure mount targets are associated with appropriate subnets
Expected Result
- Mount targets should exist in each availability zone where the EFS is used
- Each mount target should be in a different availability zone for redundancy
- Mount targets should be properly associated with VPC subnets
Remediation
Console
Control access by modifying mount targets in each availability zone.
- Navigate to EFS console
- Select your file system
- Configure mount targets for each availability zone
- Ensure proper subnet association for high availability
Default Value
Mount targets are not created by default. Users must explicitly create mount targets when setting up an EFS file system.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control ListsConfigure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | ● | ● | ● |
| v8 | 6.8 Define and Maintain Role-Based Access ControlDefine and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently. | ● | ||
| v7 | 14.6 Protect Information through Access Control ListsProtect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. | ● | ● | ● |
| v7 | 14.7 Enforce Access Control to Data through Automated ToolsUse an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data even when data is copied off a system. | ● |
Profile
Level 2