Metadata

Id: cloudformation-aws-efs-volume-with-disabled-transit-encryption

Provider: AWS

Platform: CloudFormation

Severity: Medium

Category: Encryption

Learn More

• Provider Reference

Description

Amazon ECS task definitions that mount Amazon EFS volumes must enable in-transit encryption to protect data transmitted between containers and the file system from interception or tampering.

In CloudFormation, the AWS::ECS::TaskDefinition resource’s Properties.volumes[*].efsVolumeConfiguration.TransitEncryption property must be defined and set to ENABLED. Resources missing this property or with TransitEncryption set to any value other than ENABLED will be flagged.

Secure example:

MyTaskDefinition:
  Type: AWS::ECS::TaskDefinition
  Properties:
    Family: my-task
    ContainerDefinitions: []
    Volumes:
      - Name: MyEfsVolume
        EFSVolumeConfiguration:
          FileSystemId: fs-0123456789abcdef0
          TransitEncryption: ENABLED