AWS efs medium security documentation change
Summary
Added detailed section explaining mount target requirements and security group/IAM policy relationships with access points
Security assessment
The change explicitly documents security controls: security groups applied at mount target level and introduces IAM condition key 'elasticfilesystem:AccessedViaMountTarget' which enforces access through mount targets. This clarifies security boundaries and access control mechanisms.
Diff
diff --git a/efs/latest/ug/efs-access-points.md b/efs/latest/ug/efs-access-points.md index 542a0929e..59fe6fc57 100644 --- a//efs/latest/ug/efs-access-points.md +++ b//efs/latest/ug/efs-access-points.md @@ -4,0 +5,2 @@ +Access points work with mount targets + @@ -11 +13,13 @@ You can use AWS Identity and Access Management (IAM) policies to enforce that sp -###### Note +You can create access points for an existing EFS file system using the AWS Management Console, the AWS Command Line Interface (AWS CLI), and the Amazon EFS API. For step-by-step procedures to create an access point, see [Creating access points](./create-access-point.html). + +## Access points work with mount targets + +You must create at least one mount target in your VPC before using access points. Mount targets provide the network connectivity to your EFS file system while access points provide the access control and application-specific entry points. + +Access points inherit the mount target's Availability Zone placement. + + * Security groups are applied at the mount target level, not the access point level. + + * Access points are available in all Availability Zones where you have mount targets. + + * The IAM condition key `elasticfilesystem:AccessedViaMountTarget` ensures file system access only occurs through mount targets, which applies to both direct mounts and access point mounts. @@ -13 +26,0 @@ You can use AWS Identity and Access Management (IAM) policies to enforce that sp -You need to create at least one mount target on your EFS file system to use access points. @@ -15 +27,0 @@ You need to create at least one mount target on your EFS file system to use acce -You can create access points for an existing EFS file system using the AWS Management Console, the AWS Command Line Interface (AWS CLI), and the Amazon EFS API. An EFS file system can have a [maximum of 10,000 access points](./limits.html#soft-limits). You cannot modify an existing access point after it's created. @@ -17 +28,0 @@ You can create access points for an existing EFS file system using the AWS Manag -For step-by-step procedures to create an access point, see [Creating access points](./create-access-point.html).