EFS Volume With Disabled Transit Encryption
- Query id: c1282e03-b285-4637-aee7-eefe3a7bb658
- Query name: EFS Volume With Disabled Transit Encryption
- Platform: CloudFormation
- Severity: Medium
- Category: Encryption
- CWE: 319
- Risk score: 5.5
- URL: Github
Description¶
Amazon EFS volume does not have encryption for data at transit enabled. To prevent such a scenario, enable the attribute 'TransitEncryption'
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "A sample template",
"Resources": {
"taskdefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"ContainerDefinitions": [
{
"Name": "container-using-efs",
"Image": "amazonlinux:2",
"EntryPoint": [
"sh",
"-c"
],
"Command": [
"ls -la /mount/efs"
],
"MountPoints": [
{
"SourceVolume": "myEfsVolume",
"ContainerPath": "/mount/efs",
"ReadOnly": true
}
]
}
],
"Volumes": [
{
"name": "myEfsVolume",
"EFSVolumeConfiguration": {
"fileSystemId": "fs-1234",
"rootDirectory": "/path/to/my/data",
"TransitEncryptionPort": 10,
"TransitEncryption": "DISABLED"
}
}
]
}
}
}
}
Positive test num. 2 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "A sample template",
"Resources": {
"taskdefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"ContainerDefinitions": [
{
"Name": "container-using-efs",
"Image": "amazonlinux:2",
"EntryPoint": [
"sh",
"-c"
],
"Command": [
"ls -la /mount/efs"
],
"MountPoints": [
{
"SourceVolume": "myEfsVolume",
"ContainerPath": "/mount/efs",
"ReadOnly": true
}
]
}
],
"Volumes": [
{
"Name": "myEfsVolume",
"EFSVolumeConfiguration": {
"FileSystemId": "fs-1234",
"RootDirectory": "/path/to/my/data",
"TransitEncryptionPort": 10
}
}
]
}
}
}
}
Positive test num. 3 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "A sample template",
"Resources": {
"taskdefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"ContainerDefinitions": [
{
"Name": "container-using-efs",
"Image": "amazonlinux:2",
"EntryPoint": [
"sh",
"-c"
],
"Command": [
"ls -la /mount/efs"
],
"MountPoints": [
{
"SourceVolume": "myEfsVolume",
"ContainerPath": "/mount/efs",
"ReadOnly": true
}
]
}
],
"Volumes": [
{
"Name": "myEfsVolume"
}
]
}
}
}
}
Positive test num. 4 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "A sample template",
"Resources": {
"taskdefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"ContainerDefinitions": [
{
"Name": "container-using-efs",
"Image": "amazonlinux:2",
"EntryPoint": [
"sh",
"-c"
],
"Command": [
"ls -la /mount/efs"
],
"MountPoints": [
{
"SourceVolume": "myEfsVolume",
"ContainerPath": "/mount/efs",
"ReadOnly": true
}
]
}
]
}
}
}
}
Positive test num. 5 - yaml file
Resources:
taskdefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
-
Name:
Ref: "AppName"
MountPoints:
-
SourceVolume: "my-vol"
ContainerPath: "/var/www/my-vol"
EntryPoint:
- "/usr/sbin/apache2"
- "-D"
Name: "busybox"
Image: "busybox"
Cpu: 256
EntryPoint:
- "sh"
- "-c"
Memory: 512
Command:
- "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
Essential: false
VolumesFrom:
-
SourceContainer:
Ref: "AppName"
Volumes:
-
Host:
SourcePath: "/var/lib/docker/vfs/dir/"
EFSVolumeConfiguration:
TransitEncryption: DISABLED
Name: "my-vol"
Positive test num. 6 - yaml file
Resources:
taskdefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
-
Name:
Ref: "AppName"
MountPoints:
-
SourceVolume: "my-vol"
ContainerPath: "/var/www/my-vol"
EntryPoint:
- "/usr/sbin/apache2"
- "-D"
Name: "busybox"
Image: "busybox"
Cpu: 256
EntryPoint:
- "sh"
- "-c"
Memory: 512
Command:
- "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
Essential: false
VolumesFrom:
-
SourceContainer:
Ref: "AppName"
Volumes:
-
Host:
SourcePath: "/var/lib/docker/vfs/dir/"
EFSVolumeConfiguration:
Name: "my-vol"
Positive test num. 7 - yaml file
Resources:
taskdefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
-
Name:
Ref: "AppName"
MountPoints:
-
SourceVolume: "my-vol"
ContainerPath: "/var/www/my-vol"
EntryPoint:
- "/usr/sbin/apache2"
- "-D"
Name: "busybox"
Image: "busybox"
Cpu: 256
EntryPoint:
- "sh"
- "-c"
Memory: 512
Command:
- "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
Essential: false
VolumesFrom:
-
SourceContainer:
Ref: "AppName"
Volumes:
-
Host:
SourcePath: "/var/lib/docker/vfs/dir/"
Name: "my-vol"
Positive test num. 8 - yaml file
Resources:
taskdefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
-
Name:
Ref: "AppName"
MountPoints:
-
SourceVolume: "my-vol"
ContainerPath: "/var/www/my-vol"
EntryPoint:
- "/usr/sbin/apache2"
- "-D"
Name: "busybox"
Image: "busybox"
Cpu: 256
EntryPoint:
- "sh"
- "-c"
Memory: 512
Command:
- "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
Essential: false
VolumesFrom:
-
SourceContainer:
Ref: "AppName"
Code samples without security vulnerabilities¶
Negative test num. 1 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "A sample template",
"Resources": {
"taskdefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"ContainerDefinitions": [
{
"Name": "container-using-efs",
"Image": "amazonlinux:2",
"EntryPoint": [
"sh",
"-c"
],
"Command": [
"ls -la /mount/efs"
],
"MountPoints": [
{
"SourceVolume": "myEfsVolume",
"ContainerPath": "/mount/efs",
"ReadOnly": true
}
]
}
],
"Volumes": [
{
"name": "myEfsVolume",
"EFSVolumeConfiguration": {
"fileSystemId": "fs-1234",
"rootDirectory": "/path/to/my/data",
"TransitEncryptionPort": 10,
"TransitEncryption": "ENABLED"
}
}
]
}
}
}
}
Negative test num. 2 - yaml file
Resources:
taskdefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ContainerDefinitions:
-
Name:
Ref: "AppName"
MountPoints:
-
SourceVolume: "my-vol"
ContainerPath: "/var/www/my-vol"
EntryPoint:
- "/usr/sbin/apache2"
- "-D"
Name: "busybox"
Image: "busybox"
Cpu: 256
EntryPoint:
- "sh"
- "-c"
Memory: 512
Command:
- "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\""
Essential: false
VolumesFrom:
-
SourceContainer:
Ref: "AppName"
Volumes:
-
Host:
SourcePath: "/var/lib/docker/vfs/dir/"
EFSVolumeConfiguration:
TransitEncryption: ENABLED
Name: "my-vol"