Creating an IAM Policy Requiring that all EFS File Systems be Encrypted - Encrypting File Data with Amazon Elastic File System

Creating an IAM Policy Requiring that all EFS File Systems be Encrypted

You can create an IAM identity-based policy that authorizes users to create only encrypted Amazon EFS file systems using the console, the AWS CLI, or the API. The following procedure describes how to create such a policy using the IAM console, and then apply the policy to a user in your account.

To create an IAM policy to enforce encrypted EFS file systems:

  1. Sign in to the AWS Management Console and open the IAM console.

  2. In the navigation pane, under Access Managementchoose Policies.

  3. Choose Create policy to display the Create policy page.

  4. In the Visual Editor tab, enter the following information.

    • For Service, choose EFS.

    • For Actions, enter create in the search field, and then choose CreateFileSystem.

    • For Request conditions, click on the Add condition link, search for elasticfilesystem:Encrypted for Condition Key, Bool for Operator and true for Value.

  5. Provide a Name and a Description for the policy. Verify the policy summary, including the Encrypted request condition.

  6. Choose Create policy to create the policy.

To apply the policy to a user in your account:

  1. In the IAM console, under Access management, choose Users.

  2. Select the user that you want to apply the policy to.

  3. Choose Add permissions to display the Add permissions page.

  4. Choose Attach existing policies directly.

  5. Enter the name of the EFS policy that you created in the previous procedure.

  6. Select and expand the policy. Then choose {}JSON to verify the policy content. It should look like the following JSON policy.

    {
  “Version”: “2012-10-17”,
  “Statement”: [
    {
      “Sid”: “VisualEditior0”,
      “Effect”: “Allow”,
      “Action”: “elasticfilesystem:CreateFileSystem”,
      “Condition”: {
        “Bool”: {
          “elasticfilesystem:Encrypted”: “true”
        }
      },
      “Resource”: “*”
    }
}