[EFS]: default file system policy will be created by file_system_policy=None

[IllarionovDimitri]

Describe the bug

During creation of EFS with explicit or implicit setting file_system_policy=None the following policy will be created on a file system.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientWrite"
            ],
            "Resource": "arn:aws:elasticfilesystem:eu-west-1:<AWS-ACCOUNT>:file-system/<EFS-ID>",
            "Condition": {
                "Bool": {
                    "elasticfilesystem:AccessedViaMountTarget": "true"
                }
            }
        }
    ]
}

This causes an error e.g. on ECS Task to create a volume and mount point on EFS. By removing the policy from EFS the creation of mount point succeeds

Expected Behavior

In case file_system_policy=None or not providing it at all no policy is created on EFS

Current Behavior

Regardless of file_system_policy value the policy on file system is created

Reproduction Steps

create an EFS using efs.FileSystem(...) class without providing any policy to file_system_policy parameter (default is None)

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.147.3 (build 32f0fdb)

Framework Version

No response

Node.js Version

v20.11.1

OS

Ubuntu 20.04

Language

Python

Language Version

No response

Other information

No response

[IllarionovDimitri]

duplicate of aws_efs (Python): Incorrect File System Policy defaults #27374

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.