EFS file system should use a customer-managed KMS key

What it checks

EFS file system: encryption is enabled but no CMK is specified.

Where it applies

Terraform: aws_efs_file_system

CloudFormation: AWS::EFS::FileSystem

How to fix it

1. Specify kms_key_id when creating the EFS file system. Note: CMK can only be specified at creation — requires file system recreation to change.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules