Your team is building up an application, and an Amazon Elastic File System (EFS) is required to share data across different nodes. For the EFS file system, you need to configure a policy to enforce some default security rules. For example, the root access should be disabled, and connections from EFS clients must use TLS. Which method is the most suitable?

Answer options:

A.Attach an IAM identity policy to each IAM entity to perform specific actions on the file system.
B.Configure an EFS file system policy to control NFS client access to the EFS resource.
C.Create an EFS service-linked role and attach it to the file system.
D.Add the TLS option when mounting the file system with the EFS mount helper.

Correct Answer – B
Option A is incorrect: Because the EFS file system needs to enforce a default IAM policy. The EFS resource policy should be used instead of the IAM identity policy.
Option B is CORRECT: Because the file system policy is suitable to control permissions for various EFS actions.
Option C is incorrect: Because the EFS service-linked role is managed by AWS and is used to call other AWS services on your behalf. It cannot be used to enforce default security rules.
Option D is incorrect: Because the resource policy should be attached in the EFS file system. It is not enough to configure the EFS mount helper.
Reference:
https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html