// Module included in the following assemblies:
//
// * storage/persistent_storage/persistent-storage-csi-aws-efs.adoc
// * storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc

:_mod-docs-content-type: REFERENCE
[id="efs-security_{context}"]
= Amazon Elastic File Storage security

[role="_abstract"]
When using Amazon Elastic File Storage (EFS) with access points, understand that file permissions are controlled by the access point rather than Kubernetes FSGroup settings, allowing any pod with access to read all files.

When using access points, for example, by using dynamic provisioning as described earlier, Amazon automatically replaces GIDs on files with the GID of the access point. In addition, EFS considers the user ID, group ID, and secondary group IDs of the access point when evaluating file system permissions. EFS ignores the NFS client's IDs. For more information about access points, see "Working with access points".

As a consequence, EFS volumes silently ignore FSGroup; {product-title} is not able to replace the GIDs of files on the volume with FSGroup. Any pod that can access a mounted EFS access point can access any file on it.

Unrelated to this, encryption in transit is enabled by default. For more information, see "Encrypting data in transit".
