Policy Packs

guardrails-samples

Ensure that all data stored within file systems is encrypted, protecting it from unauthorized access and potential data breaches.

Enforce Encryption at Rest Is Enabled for AWS EFS File Systems

main

aws_efs_file_system_approved

Determine the action to take when an AWS EFS filesystem is not approved based on `AWS &gt; EFS &gt; FileSystem &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

fileSystemApproved

AWS > EFS > FileSystem > Approved

aws_efs_file_system_approved_encryption_at_rest

Define the Encryption at Rest settings required for `AWS &gt; EFS &gt; FileSystem`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/v5/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EFS &gt; FileSystem &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n

fileSystemEncryptionAtRest

AWS > EFS > FileSystem > Approved > Encryption at Rest

aws_efs_file_system_approved_encryption_at_rest_customer_managed_key

Define the KMS key ID for encryption at rest.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/v5/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EFS &gt; FileSystem &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n&#92;nPlease make sure the key defined in the template has required permissions.&#92;n&#92;n```&#92;nexample:&#92;n  alias/aws/ebs&#92;n  ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs&#92;n```&#92;n

fileSystemEncryptionAtRestCustomerManagedKey

AWS > EFS > FileSystem > Approved > Encryption at Rest > Customer Managed Key

turbot_policy_setting.aws_efs_file_system_approved

turbot_policy_setting.aws_efs_file_system_approved_encryption_at_rest

turbot_policy_setting.aws_efs_file_system_approved_encryption_at_rest_customer_managed_key

Policy	Setting	Note
AWS > EFS > FileSystem > Approved	Check: Approved
AWS > EFS > FileSystem > Approved > Encryption at Rest	AWS managed key or higher
AWS > EFS > FileSystem > Approved > Encryption at Rest > Customer Managed Key	alias/turbot/default

Policy Settings