<p>We are currently building a multi-tenant cluster in EKS. For our persistent storage, we are using the Amazon EFS CSI driver <a href="https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html</a>.</p>
<p>We are trying to use a single EFS with a different folder for each PV.</p>
<p>The issue we are facing is the security group needs to be applied at the node group level, so right now any pod with high enough privilege can just mount the EFS drive and delete anything on it.</p>
<p>Is there any way to resolve this security issue?</p>

<p>AFAIK, the only way is to make use <a href="https://docs.aws.amazon.com/efs/latest/ug/accessing-fs-nfs-permissions.html" rel="nofollow noreferrer">UNIX style permissions in your EFS drive</a>. Basically, you can create these permissions ahead of time for the subdirectories, based on a UNIX UID/GID, and then you can force your pods to start a certain UID/GID (and <code>fsGroup</code>) using a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">SecurityContext</a>.</p>
<p>Additionally, you can also make use of <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">MutatingAdminssionWebhooks</a> so that your pods always get a securityContext automatically added based on say the namespace that they run on.</p>
