Elastic File System should be configured to encrypt file data at-rest using AWS KMS

How to fix it

• Replaces the resource: Encryption cannot be turned on in place: replicate to a new file system, stop writes, delete the replication so the copy is writable, add its mount targets and access points, then delete this one.
• Interrupts service: Writes made after the last sync are not copied, so clients are down from the write freeze until they remount the new file system.
• Affects another check: The copy also passes EFS.8, which reads the same setting, but turn on its automatic backups, which replication enables by default only for One Zone copies, or EFS.7 fails.

In the console

EFS → File systems → the file system → Replication → Create replication

Replication configuration

New file system

Destination AWS Region

This file system's Region

File system type

Regional or One Zone, as this file system is

Encryption

Always on for the copy; the default aws/elasticfilesystem key or a customer managed key, which cannot change later

With the AWS CLI

aws efs create-replication-configuration --source-file-system-id <file-system-id> --destinations Region=<region> --region <region>

With Terraform

resource "aws_efs_replication_configuration" "this" {
  source_file_system_id = var.file_system_id

  destination {
    region = var.region
  }
}