How to Prevent EFS Dataset Modification with IAM Access Control

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls. Design secure access to AWS resources.

Short answer

B Create an EFS resource policy that denies elasticfilesystem:ClientWrite to the IAM roles attached to the EC2 instances.

Question

A company has an Amazon Elastic File System (Amazon EFS) file system that contains a reference dataset. The company has applications on Amazon EC2 instances that need to read the dataset. However, the applications must not be able to change the dataset. The company wants to use IAM access control to prevent the applications from being able to modify or delete the dataset. Which solution will meet these requirements?
  1. Mount the EFS file system in read-only mode from within the EC2 instances.
  2. Create a resource policy for the EFS file system that denies the elasticfilesystem:ClientWrite action to the IAM roles that are attached to the EC2 instances. Correct Answer
  3. Create an identity policy for the EFS file system that denies the elasticfilesystem:ClientWrite action on the EFS file system.
  4. Create an EFS access point for each application. Use Portable Operating System Interface (POSIX) file permissions to allow read-only access to files in the root directory.

Key Takeaways

The question tests whether you can distinguish EFS resource-based policies from identity policies and OS-level mount options; the common trap is choosing a read-only mount or POSIX permission approach that does not use IAM as required.

Amazon EFS supports IAM access control through file system resource policies that deny elasticfilesystem:ClientWrite to specific IAM roles. This page establishes that option B is the correct SAA-C03 solution because it attaches the deny to the EFS resource while preserving read access for the EC2 applications.

Common mistake: Candidates often choose C, assuming an identity policy can deny elasticfilesystem:ClientWrite on the EFS file system, but identity policies attach to IAM users, groups, or roles—not to AWS resources like EFS.

Expert Analysis

Why the Answer Is Correct

Amazon EFS file system policies are resource-based policies that attach directly to the file system and can specify IAM principals. By denying elasticfilesystem:ClientWrite to the IAM roles attached to the EC2 instances, the policy blocks data modification and deletion while still permitting the ClientMount action needed to read the dataset. This is the only option that satisfies the scenario's explicit requirement for IAM access control. AWS documents this exact mechanism in the EFS IAM access control topic, where ClientWrite is described as the action that provides write permissions on a file system.

Why the Other Options Are Wrong

Option A mounts the file system read-only at the operating-system level, which is not IAM access control and can be changed by anyone with remount privileges. Option C is invalid because it describes an identity policy for the EFS file system—identity policies attach to IAM users, groups, or roles, not to EFS resources; a resource policy is required to attach to the file system. Option D relies on EFS access points and POSIX permissions rather than IAM, so it fails the stated IAM requirement and POSIX permissions alone can be bypassed depending on root access settings.

Community Comment Notes

Most voters correctly chose B. As lenotc explained, "identity policies are typically associated with users or roles", not the EFS file system, and sandordini pointed out that "The question clearly states they are looking to use IAM access control", which eliminates options A and D. MatAlves reinforced that EFS is a resource, so a resource policy—not an identity policy—is the right attachment point, while elmyth noted there is "no such thing as an \"identity policy\" for EFS". A minority (osmk and Oo_Cc) selected C by focusing only on the IAM requirement, but their choice ignores the attachment semantics that make C structurally wrong.

Official Reference

https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a scenario explicitly requires IAM access control, eliminate any option that relies on OS mount flags or POSIX permissions first. Then check the policy attachment point: resource-based policies belong on the EFS file system, while identity-based policies belong on the IAM role, and only the resource policy directly matches the deny-Write requirement.

Frequently Asked Questions

Why is option C wrong if it also uses IAM to deny ClientWrite?

Option C describes an identity policy attached to the EFS file system, but identity policies attach only to IAM users, groups, or roles. The deny must come from an EFS resource policy (option B).

Does denying elasticfilesystem:ClientWrite still allow the EC2 instances to read the dataset?

Yes. ClientWrite controls write and delete permissions, while ClientMount grants read access when the EFS file system uses IAM authorization with the instance role.

More SAA-C03 FAQ →

Community Votes

B
76%
C
24%

76% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. hajra313 👍 6
    Create an EFS access point for each application. Use Portable Operating System Interface (POSIX) file permissions to allow read-only access to files in the root directory. Explanation: By creating an EFS access point for each application and configuring POSIX file permissions to allow read-only access, you can enforce the desired access control. This approach restricts write and delete actions on the dataset while allowing read access, aligning with the company's requirements.
  2. lenotc 👍 6 Answered B
    B correct best solution best well architected C wrong because identity policies are typically associated with users or roles, not directly with the EFS file system D wrong because POSIX file permissions at the root directory level may not be sufficient to prevent modifications to other directories or files A is so far away
  3. xBUGx 👍 4
    IAM policies are used to control access to AWS resources, including Amazon EFS. By default, IAM policies control access to the EFS API actions, such as elasticfilesystem:ClientWrite, which allows clients to write to the file system. However, POSIX file permissions control access to files within the file system itself, which is independent of IAM policies. While using POSIX file permissions can restrict access to the files within the file system, it doesn't prevent a user or application with the appropriate IAM permissions from modifying or deleting those files directly through the EFS API.
  4. Ansuman_lucky 👍 4
    prevent the applications from being able to modify or delete the dataset.-- This means a role would be used. So answer is B
  5. HarryLopez 👍 3 Answered B
    B) IAM needs to be used, so A) & D) are out. So b/w B) and C), Resource policies are meant for specific aws service or resource while Identity policies are attached to an identity (user, group or role). C) attached identity policy to EFS, dont know how and why. Hence, B).
Show 7 more comments
  1. sandordini 👍 3 Answered B
    2 ways to prevent writing to the file system: 1. The mount option in the /etc/fstab file is set to read-only access. > A 2. IAM policy indicates read-only access, or root access disabled. > B The question clearly states they are looking to use IAM access control
  2. osmk 👍 3 Answered C
    company wants to use IAM access control to prevent https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html
  3. MatAlves 👍 2 Answered B
    - Identity-based policies are attached to an IAM user, group, or role. - Resource-based policies are attached to a resource. - elasticfilesystem:ClientWrite: Provides write permissions on a file system. EFS is a RESOURCE, so that excludes "C" (we need a resource policy). https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html
  4. Oo_Cc 👍 2 Answered C
    "The company wasn't to use IAM access control". Yes, it would deny writing action to everything .. but it's still the only one that uses IAM.
  5. elmyth 👍 2 Answered B
    There is no such thing as an "identity policy" for EFS.
  6. Andy_09 👍 5
    Option B
  7. jaswantn 👍 1 Answered D
    option D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide