EFS(8)

📦
version 2.0.3 · 2 versions
, in alpine 3.24, fedora 43, opensuse-leap 16.0

EFS(8) 💖

System Manager's Manual · EFS(8)

okay bestie, this is mount.efs — the mount helper for Amazon EFS file systems. she's part of the amazon-efs-utils package and she's genuinely iconic, no cap.

✨ NAME ✨

mount.efs — Mount helper for using Amazon EFS file systems. 🦋

✨ SYNOPSIS ✨

mount.efs fs-id-or-dns-name mount-point [-o options]

✨ DESCRIPTION ✨

so mount.efs ships inside the amazon-efs-utils package, and her whole deal is making mount performance better and making EFS file systems way less annoying to use. 💅

you're meant to use mount.efs through the mount(8) command to mount EFS file systems, not by yelling at it directly.

what she actually does? mount.efs launches a proxy process that forwards NFS traffic from the kernel's NFS client over to EFS. that proxy is the one handling TLS encryption, and it's also the one serving up improved throughput performance. she's carrying the whole team fr fr. 🔥

fs-id-or-dns-name has to be one of these two forms, periodt:

  • An EFS filesystem ID shaped like "fs-abcd1234", which gets generated when the file system is created. 👑
  • A domain name that has a resolvable DNS-CNAME record, which in turn points to a fully-qualified EFS DNS name shaped like "fs-abcd1234.efs.us-east-1.amazonaws.com" or "us-east-1a.fs-abcd1234.efs.us-east-1.amazonaws.com". 🎀

mount-point is the local directory where the file system is gonna be mounted. 🏠

mount.efs automatically applies these NFS options, like she's doing your homework for you:

nfsvers=4.1
rsize=1048576
wsize=1048576
hard
timeo=600
retrans=2
noresvport
tls (for Mac distributions)

by default, when you use the Amazon EFS mount helper with Transport Layer Security (TLS), the mount helper enforces the certificate hostname checking and disables the use of Online Certificate Status Protocol (OCSP). both of those can be configured in the config file located at /etc/amazon/efs/efs-utils.conf. ⚙️

also!! the Amazon EFS mount helper has built-in logging for troubleshooting purposes. those logs live at /var/log/amazon/efs. 📝

and yes, you can configure your Amazon EC2 instance to automatically remount your Amazon EFS file system when it reboots. for more info, the online documentation is at: https://docs.aws.amazon.com/efs/latest/ug/mount-fs-auto-mount-onreboot.html. 🫶

✨ OPTIONS ✨

-o — options are specified with a -o flag followed by a comma separated string of options. all of the options specified in nfs(5) are available, plus the EFS-specific ones below. 🌈

  • tls — Mounts the EFS file system over TLS. For EC2 instances using Mac distributions, this option is by default passed and the EFS file system is mounted over TLS. 🔐
  • notls — Mounts the EFS file system without TLS, applies for Mac distributions only.
  • tlsport=n — Configures the proxy process to listen for connections from the NFS client on the specified port. This is applicable to both non-tls and tls mounts. By default, the tlsport is chosen randomly from port range defined in the config file located at /etc/amazon/efs/efs-utils.conf.
  • verify=n — Verify TLS certificates using the specified stunnel verify level. For more information, see stunnel(8).
  • ocsp / noocsp — Selects whether to perform OCSP validation on TLS certificates, overriding /etc/amazon/efs/efs-utils.conf. By default OCSP is disabled. For more information, see stunnel(8).
⚠️ the ocsp mount option is incompatible with the efs-proxy process, and will revert efs-utils to the legacy "stunnel" mode, which does not support improved per-client throughput performance. so like, you get OCSP but you lose the speed. your call bestie. 💀
  • iam — Use the system's IAM identity to authenticate with EFS. The mount helper will try to retrieve the required IAM credentials from the following locations: the aws credentials URI passed by mount option, the AWS CLI credentials file (~/.aws/credentials), and the AWS CLI config file (~/.aws/config), the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable, the AssumeRoleWithWebIdentity, the EC2 instance profile. The first location that has credentials will be used. This option requires the tls option. 🪪
  • rolearn — Role ARN for IAM authentication with AssumeRoleWithWebIdentity API.
  • jwtpath — Identity token for IAM authentication with AssumeRoleWithWebIdentity API.
  • accesspoint — Mount the EFS file system using the specified access point. This option requires the tls option. The access point must be in the "available" state before it can be used to mount EFS. ✅
  • awsprofile — Use the named profile used to lookup IAM credentials in the AWS CLI credentials file (~/.aws/credentials) or AWS CLI config file (~/.aws/config). If botocore is installed, assume the named profile and use the credentials of the assumed profile. If "awsprofile" is not specified, the "default" profile is used.
  • awscredsuri — Use the relative uri to lookup IAM credentials from ecs task metadata endpoint.
  • cafile — Use the cafile as the stunnel certificate authority file. 📜
  • netns — Mount the EFS file system to the specified network namespace.
  • az — Mount the EFS file system to the specified availability zone mount target. 🌍
  • mountport — Use the port 2049 to bypass portmapper daemon on EC2 Mac instances running macOS Big Sur.
  • mounttargetip — Mount the EFS file system to the specified mount target ip address.
  • stunnel — Forward NFS traffic from the local NFS client to EFS using stunnel instead of efs-proxy. This will enable compatibility with the ocsp mount option, but will not deliver the increased throughput performance provided by efs-proxy. This option is enabled by default for Mac clients.

✨ EXAMPLES ✨

okay these are the actual commands, copy them exactly, don't freestyle. 🎀

sudo mount -t efs fs-abcd1234 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" without encryption of data in transit.

sudo mount -t efs -o mounttargetip=192.0.0.1 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" on the mount target that belongs to the file system with address "192.0.0.1" without encryption of data in transit.

sudo mount -t efs -o netns=/proc/1/net/ns fs-abcd1234 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" without encryption of data in transit in given network namespace '/proc/1/net/ns'.

sudo mount -t efs -o az=us-east-1a fs-abcd1234 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" to the mount target in availability zone us-east-1a.

sudo mount -t efs fs-abcd1234:/child /mnt/efs

Mount a non-root directory of an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" without encryption of data in transit.

sudo mount -t efs -o tls fs-abcd1234 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" using encryption of data in transit. 🔐

sudo mount -t efs -o tls,verify=0 fs-abcd1234 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" using encryption of data in transit and a verify level of 0.

sudo mount -t efs -o tls,ocsp fs-abcd1234 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" using encryption of data in transit and with OCSP validation enabled.

sudo mount -t efs custom-cname.example.com /mnt/efs

Mount an EFS file system using the custom DNS name "custom-cname.example.com" — which has to resolve to a fully-qualified EFS DNS name such as "fs-abcd1234.efs.us-east-1.amazonaws.com" — at mount point "/mnt/efs" without encryption of data in transit.

sudo mount -t efs -o tls custom-cname.example.com /mnt/efs

Mount an EFS file system using the custom DNS name "custom-cname.example.com" — which has to resolve to a fully-qualified EFS DNS name such as "fs-abcd1234.efs.us-east-1.amazonaws.com" — at mount point "/mnt/efs" using encryption of data in transit.

sudo mount -t efs -o tls,iam fs-abcd1234 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" with encryption of data in transit. The mount helper will authenticate with EFS using the system's IAM identity. 🪪

sudo mount -t efs -o
tls,iam,rolearn="ROLE_ARN",jwtpath="PATH/JWT_TOKEN_FILE" fs-abcd1234
/mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" with encryption of data in transit. The mount helper will assume the role "ROLE_ARN" by calling the AssumeRoleWithWebIdentity API with the identity token at "PATH/JWT_TOKEN_FILE".

sudo mount -t efs -o tls,iam,awsprofile=test-profile fs-abcd1234
/mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" with encryption of data in transit. The mount helper will authenticate with EFS using the system's IAM identity named profile "test profile", for which the credentials are retrieved either from /root/.aws/credentials or /root/.aws/config. If the credentials are not present in the credentials or config files, and there is a "[profile test-profile]" section in the /root/.aws/config file, the mount helper will assume the named profile "test-profile" based on the profile section configuration in root/.aws/config and use the credentials retrieved with botocore to mount (botocore must be pre-installed).

sudo mount -t efs -o tls,accesspoint=fsap-12345678 fs-abcd1234 /mnt/efs

Mount an EFS file system with file system ID "fs-abcd1234" at mount point "/mnt/efs" with encryption of data in transit. The file system is mounted using the access point "fsap-12345678". ⭐

still more to come bestie, don't go anywhere 💜

🗂️ FILES 🗂️

okay so here's the whole map of where everything lives on your system, bestie. memorize these paths, they will absolutely come up. 💅

  • /sbin/mount.efs — this is the actual executable, the moment, the main character. it's the Amazon EFS mount helper itself.
  • /usr/bin/amazon-efs-mount-watchdog — the executable for the supervisor process, aka the little guardian angel that keeps an eye on the network relay. 👑
  • /etc/amazon/efs/efs-utils.conf — the config file for the Amazon EFS mount helper. this is where you go when you wanna change stuff.
  • /etc/amazon/efs/efs-utils.crt — the default Certificate Authority file that the Amazon EFS mount helper uses. 🔐
  • /etc/init/amazon-efs-mount-watchdog.conf — the config file for the supervisor process. yes, the watchdog gets its own config, she's got range.
  • /var/log/amazon/efs/ — the directory where all the logs live: the Amazon EFS mount helper logs, the stunnel network relay logs, and the supervisor process logs. all three roomies in one house. 🏠
  • /usr/share/man/man8/mount.efs.8 — the man page for the Amazon EFS mount helper. hi, that's literally the page you're reading rn. meta. 💀

🧠 NOTES 🧠

want the full lore? for more info on using the amazon-efs-utils package, go read https://docs.aws.amazon.com/efs/latest/ug/using-amazon-efs-utils.html in the Amazon EFS User Guide. it's giving required reading, ngl. 📚

also PSA for the Mac girlies 🍓 — on EC2 MacOS instances, the paths get relocated and live under the /usr/local/Cellar/amazon-efs-utils/<version>/libexec directory. so don't go looking for them in the usual spots, they moved, it's their new apartment. ✨

👀 SEE ALSO 👀

go read these too, they're all connected, iykyk:

⚖️ COPYING ⚖️

Copyright 2017-2018 Amazon.com, Inc. and its affiliates. All Rights Reserved.

and that's the whole page, bestie, you ate it up fr fr 🎀✨ the footer says this is EFS(8) — that's the section 8 version of the page, dated as shown down there at the bottom. go forth and mount responsibly 💖🦋🌸

📦 where this page comes from