iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

EFS

By · Reviewed & last updated · Part of AWS Tutorial

Elastic File System (EFS) is the managed NFS that scales elastically: petabyte-scale, regional or one-zone, IAM-aware, with throughput modes for bursty workloads and provisioned IOPS for predictable ones. Use it for shared file storage across many containers/instances — WordPress uploads, ML training datasets, Jenkins workspaces — where EBS (single-attach) does not fit.

Create, mount, secure, and tune EFS

EXAMPLE
# 1) Create a filesystem — encrypted at rest by default
aws efs create-file-system \
  --performance-mode generalPurpose \
  --throughput-mode elastic \
  --encrypted \
  --tags Key=Name,Value=shop-shared

# 2) Allow EC2 / EKS to reach EFS — mount targets per AZ, plus a security group
sg=$(aws ec2 create-security-group --group-name efs-clients --description 'EFS NFS 2049' \
        --vpc-id vpc-0abc1234 --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $sg \
  --protocol tcp --port 2049 --source-group sg-app-tier

aws efs create-mount-target --file-system-id fs-0123 --subnet-id subnet-aaa --security-groups $sg
aws efs create-mount-target --file-system-id fs-0123 --subnet-id subnet-bbb --security-groups $sg

# 3) Mount on an EC2 instance — the recommended way is amazon-efs-utils
sudo dnf install -y amazon-efs-utils    # AL2023 / RHEL 9
sudo mkdir -p /mnt/shared
sudo mount -t efs -o tls,iam fs-0123:/ /mnt/shared
# tls   = encrypt traffic in transit
# iam   = use the instance role's IAM creds (no static NFS perms)

# Persist
echo 'fs-0123:/ /mnt/shared efs _netdev,tls,iam 0 0' | sudo tee -a /etc/fstab

# 4) Access Points — give each app a chrooted view + uid mapping
aws efs create-access-point --file-system-id fs-0123 \
  --posix-user 'Uid=1001,Gid=1001' \
  --root-directory 'Path=/wordpress,CreationInfo={OwnerUid=1001,OwnerGid=1001,Permissions=0755}'

# In ECS/EKS, mount via the access point instead of the raw fs:
# volumes:
#   - name: shared
#     efs_volume_configuration:
#       file_system_id: fs-0123
#       transit_encryption: ENABLED
#       authorization_config:
#         access_point_id: fsap-abc
#         iam: ENABLED

# 5) Lifecycle policies — auto-tier cold files to EFS-IA (cheaper)
aws efs put-lifecycle-configuration --file-system-id fs-0123 \
  --lifecycle-policies 'TransitionToIA=AFTER_30_DAYS' \
                       'TransitionToPrimaryStorageClass=AFTER_1_ACCESS'
# Hot files stay in standard; cold files drop to IA at 5x cheaper /GB.

# 6) Backup with AWS Backup
aws backup put-backup-vault --backup-vault-name efs-vault
# Then create a plan in the Backup console targeting fs-0123 daily/weekly.

# 7) Throughput modes
# - Elastic (default): scales bursts automatically; pay per GB read/write
# - Provisioned:       fixed MB/s, predictable cost
# - Bursting (legacy): credits based on filesystem size

# 8) Performance modes
# - generalPurpose:    < 7k ops/sec, lowest per-op latency
# - maxIO:             higher throughput, slightly higher latency

# 9) Monitor what matters
# CloudWatch metrics: TotalIOBytes, ClientConnections, BurstCreditBalance,
#                     PercentIOLimit (alert when > 80% for 10m)
# Real-time on the client: 'sudo nfsiostat -m 1' tells you who is the bottleneck

# 10) When EFS is wrong
# - Latency-sensitive RDBMS (pick EBS gp3 / io2)
# - Single-writer workloads (EBS is much cheaper)
# - Many tiny writes/sec (try FSx for Lustre / OpenZFS for shared scratch)

Why it matters

Always mount EFS with `-o tls,iam` and provision Access Points per workload. Transit encryption + IAM auth get you to "no plaintext NFS, no shared filesystem creds, scoped permissions per app" with three flags — a security baseline that is otherwise multiple days of work to retrofit.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# NFS-style shared filesystem — mounted by many instances.
Try it Yourself »

Discussion

Loading…