EFS without tags

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: cloudformation-aws-efs-without-tags

Provider: AWS

Platform: CloudFormation

Severity: Low

Category: Build Process

Learn More

Description

Amazon EFS file systems should be tagged to enable asset identification and to support automated policy and access controls. Missing tags make it harder to track ownership and enforce tag-based security or lifecycle rules.

The CloudFormation resource AWS::EFS::FileSystem must include the FileSystemTags property, and it must be defined (not null). Resources missing FileSystemTags or with it set to null will be flagged for remediation.

Secure configuration example:

MyEFS:
  Type: AWS::EFS::FileSystem
  Properties:
    FileSystemTags:
      - Key: Name
        Value: my-efs
      - Key: Environment
        Value: production

Compliant Code Examples


AWSTemplateFormatVersion: '2010-09-09'
Description: Create Elastic File System
Parameters:
  Owner:
    Type: String
    Default: FirstName LastName
  Project:
    Type: String
    Default: EFS Mount
  VPC:
    Type: AWS::EC2::VPC::Id
  Subnet1:
    Type: AWS::EC2::Subnet::Id
Resources:
  FileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      FileSystemTags:
      - Key: Name
        Value: !Ref AWS::StackName
      - Key: Owner
        Value: !Ref Owner
      - Key: Project
        Value: !Ref Project
  MountTarget1:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SubnetId: !Ref Subnet1
      SecurityGroups:
      - !Ref EfsSecurityGroup
  EfsSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Instance to EFS Mount Access
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Ref AWS::StackName
      - Key: Owner
        Value: !Ref Owner
      - Key: Project
        Value: !Ref Project

Non-Compliant Code Examples

AWSTemplateFormatVersion: '2010-09-09'
Description: Create Elastic File System
Parameters:
  Owner:
    Type: String
    Default: FirstName LastName
  Project:
    Type: String
    Default: EFS Mount
  VPC:
    Type: AWS::EC2::VPC::Id
  Subnet1:
    Type: AWS::EC2::Subnet::Id
Resources:
  FileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      Encrypted: true
      PerformanceMode: generalPurpose
  MountTarget1:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SubnetId: !Ref Subnet1
      SecurityGroups:
      - !Ref EfsSecurityGroup
  EfsSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Instance to EFS Mount Access
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Ref AWS::StackName
      - Key: Owner
        Value: !Ref Owner
      - Key: Project
        Value: !Ref Project