Question

A healthcare company stores patient records on an Amazon EFS file system mounted by EC2 instances in a private subnet. A compliance audit requires that all data transferred between the EC2 instances and the EFS file system be encrypted in transit, and that the requirement be technically enforced rather than reliant on documentation. The file system already has encryption at rest enabled with a customer managed KMS key. Which approach BEST meets the in-transit encryption requirement?

Accepted Answer

Mount the file system using the EFS mount helper (amazon-efs-utils) with the TLS option, and attach an EFS file system policy that denies any client connection where aws:SecureTransport is false.

Answer

Enable a second customer managed KMS key on the file system dedicated to in-transit encryption and rotate it automatically every 90 days.

Answer

Place the EFS mount targets behind a Network Load Balancer configured with a TLS listener and an ACM certificate to terminate encryption.

Answer

Configure the EC2 security group to allow NFS traffic only from trusted instances and rely on VPC network isolation to protect the data in transit.