Skip to content

Amazon EFS (Elastic File System)

Service Overview and Purpose

Amazon EFS provides a simple, scalable, and fully managed elastic NFS file system for use with AWS Cloud services and on-premises resources. EFS is built to scale on demand to petabytes without disrupting applications, growing and shrinking automatically as you add and remove files.

Key Characteristics

  • NFS v4.1 Protocol: POSIX-compliant file system
  • Fully Managed: No infrastructure management required
  • Elastic: Automatically scales up and down
  • Multi-AZ Access: Concurrent access from multiple AZs
  • High Durability: 99.999999999% (11 9's) durability

Key Features and Capabilities

Storage Classes

  1. Standard Storage Class
  2. Default storage class
  3. Multi-AZ redundancy
  4. Highest level of durability and availability

  5. Use case: Frequently accessed files

  6. Infrequent Access (IA) Storage Class

  7. Lower cost for infrequently accessed files
  8. Same durability as Standard
  9. Retrieval fees apply

  10. Use case: Files accessed a few times per quarter

  11. Archive Storage Class

  12. Lowest cost storage class
  13. For rarely accessed files
  14. Higher retrieval fees than IA

  15. Use case: Files accessed a few times per year

  16. One Zone Storage Classes

  17. One Zone: Single AZ storage
  18. One Zone-IA: Single AZ with IA pricing
  19. 90% lower cost than Standard
  20. Use case: Backup, dev/test environments

Performance Modes

  1. General Purpose Mode
  2. Default performance mode
  3. Lowest latency per operation
  4. Up to 7,000 file operations per second

  5. Use case: Latency-sensitive workloads

  6. Max I/O Mode

  7. Higher performance and throughput
  8. Higher latency per operation
  9. Virtually unlimited performance
  10. Use case: High levels of aggregate throughput

Throughput Modes

  1. Bursting Throughput
  2. Default throughput mode
  3. Throughput scales with file system size
  4. Baseline: 50 MiB/s per TiB stored

  5. Burst: Up to 100 MiB/s for file systems < 1TiB

  6. Provisioned Throughput

  7. Fixed throughput independent of storage
  8. Pay for provisioned throughput
  9. Can be higher than bursting mode

  10. Use case: High throughput to storage ratio

  11. Elastic Throughput

  12. Automatically scales throughput
  13. Pay only for throughput used
  14. Up to 3 GiB/s for reads, 1 GiB/s for writes
  15. Use case: Unpredictable throughput patterns

Core Features

Lifecycle Management

  • Automatic tiering between storage classes
  • Configurable policies (1, 7, 14, 30, 60, 90 days)
  • Intelligent tiering based on access patterns
  • Cost optimization without performance impact

Access Control

  • POSIX permissions
  • IAM integration
  • VPC security groups
  • Network ACLs
  • EFS Access Points

Backup and Restore

  • AWS Backup integration
  • Point-in-time recovery
  • Cross-region backup
  • Automatic backup policies

Use Cases and Scenarios

Primary Use Cases

  1. Content Management and Serving
  2. Web serving and content management
  3. Media processing workflows
  4. Shared content repositories

  5. Content distribution

  6. Application Development

  7. Shared application data
  8. Configuration files
  9. Development environments

  10. CI/CD pipelines

  11. Big Data Analytics

  12. Data lakes
  13. Analytics workloads
  14. Machine learning datasets

  15. Parallel processing

  16. Backup and Archive

  17. Application backups
  18. Database backups
  19. Log archival
  20. Compliance data retention

Architecture Patterns

  1. Multi-Tier Web Applications
  2. Shared static content
  3. User-uploaded files
  4. Application logs

  5. Configuration files

  6. Container Storage

  7. Kubernetes persistent volumes
  8. Docker shared storage
  9. Microservices data sharing

  10. Stateful applications

  11. High Performance Computing

  12. Parallel workloads
  13. Scientific computing
  14. Financial modeling
  15. Research datasets

Pricing Models and Cost Optimization

Pricing Components

  1. Storage Costs
  2. Standard: $0.30 per GB-month
  3. Infrequent Access: $0.0125 per GB-month
  4. Archive: $0.0045 per GB-month

  5. One Zone: 47% lower than Standard

  6. Throughput Costs

  7. Provisioned Throughput: $6.00 per MiB/s-month

  8. Elastic Throughput:

    • Read: $3.00 per GiB
    • Write: $6.00 per GiB

  9. Request Costs

  10. IA and Archive: Per-request charges
  11. Standard: No request charges

Cost Optimization Strategies

  1. Use Lifecycle Management 

    # Create lifecycle policy
aws efs put-lifecycle-configuration \
  --file-system-id fs-12345678 \
  --lifecycle-policies \
    TransitionToIA=AFTER_30_DAYS,TransitionToArchive=AFTER_90_DAYS

  2. Choose Appropriate Storage Class

  3. Analyze access patterns
  4. Use One Zone for non-critical data

  5. Consider retrieval costs for IA/Archive

  6. Optimize Throughput Mode

  7. Monitor throughput utilization
  8. Use Elastic for variable workloads

  9. Provision only when needed

  10. Regional Considerations

  11. Keep data close to compute
  12. Consider data transfer costs
  13. Use Regional vs One Zone appropriately

Configuration Details and Best Practices

EFS Creation and Configuration

# Create EFS file system
aws efs create-file-system \
  --creation-token my-efs-$(date +%s) \
  --performance-mode generalPurpose \
  --throughput-mode elastic \
  --encrypted \
  --kms-key-id alias/aws/elasticfilesystem \
  --tags Key=Name,Value=MyEFS

# Create mount targets
aws efs create-mount-target \
  --file-system-id fs-12345678 \
  --subnet-id subnet-12345678 \
  --security-groups sg-12345678

# Create access point
aws efs create-access-point \
  --file-system-id fs-12345678 \
  --posix-user Uid=1000,Gid=1000 \
  --root-directory Path="/app",CreationInfo='{
    "OwnerUid": 1000,
    "OwnerGid": 1000,
    "Permissions": "755"
  }' \
  --tags Key=Name,Value=AppAccessPoint

Mount Configuration

# Install EFS utilities (Amazon Linux 2)
sudo yum install -y amazon-efs-utils

# Create mount point
sudo mkdir /mnt/efs

# Mount using EFS helper (recommended)
sudo mount -t efs -o tls fs-12345678:/ /mnt/efs

# Mount using NFS
sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 \
  fs-12345678.efs.region.amazonaws.com:/ /mnt/efs

# Add to /etc/fstab for persistent mounting
echo 'fs-12345678.efs.region.amazonaws.com:/ /mnt/efs efs defaults,_netdev' | sudo tee -a /etc/fstab

Best Practices

  1. Security
  2. Use VPC endpoints for private access
  3. Configure security groups properly
  4. Enable encryption in transit and at rest

  5. Use EFS Access Points for application isolation

  6. Performance

  7. Choose appropriate performance mode
  8. Use regional mount targets
  9. Consider client-side caching

  10. Monitor performance metrics

  11. Availability

  12. Use multiple mount targets across AZs
  13. Implement backup strategies
  14. Monitor file system health

  15. Plan for disaster recovery

  16. Cost Management

  17. Implement lifecycle policies
  18. Monitor storage utilization
  19. Use appropriate storage classes
  20. Optimize throughput provisioning

Access Points Configuration

# Create access point with specific permissions
aws efs create-access-point \
  --file-system-id fs-12345678 \
  --posix-user Uid=1001,Gid=1001 \
  --root-directory Path="/secure",CreationInfo='{
    "OwnerUid": 1001,
    "OwnerGid": 1001,
    "Permissions": "700"
  }' \
  --tags Key=Name,Value=SecureAccessPoint

# Mount using access point
sudo mount -t efs -o tls,accesspoint=fsap-12345678 fs-12345678:/ /mnt/secure

Integration with Other AWS Services

Compute Integration

  1. EC2 Integration
  2. Direct mounting from EC2 instances
  3. Auto Scaling group integration
  4. Cross-AZ access

  5. Performance optimization

  6. Container Integration

  7. ECS: Persistent storage for containers
  8. EKS: Kubernetes persistent volumes
  9. Fargate: Serverless container storage

  10. Docker: Volume mounting

  11. Serverless Integration

  12. Lambda: File system access for functions
  13. Batch: Shared storage for jobs
  14. App Runner: Application file storage

Data Services Integration

# EKS Persistent Volume example
apiVersion: v1
kind: PersistentVolume
metadata:
  name: efs-pv
spec:
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: efs-sc
  csi:
    driver: efs.csi.aws.com
    volumeHandle: fs-12345678

Backup Integration

# Create backup vault
aws backup create-backup-vault \
  --backup-vault-name EFSBackupVault \
  --encryption-key-arn arn:aws:kms:region:account:key/key-id

# Create backup plan for EFS
aws backup create-backup-plan \
  --backup-plan '{
    "BackupPlanName": "EFSBackupPlan",
    "Rules": [{
      "RuleName": "DailyBackups",
      "TargetBackupVault": "EFSBackupVault",
      "ScheduleExpression": "cron(0 5 ? * * *)",
      "StartWindowMinutes": 480,
      "CompletionWindowMinutes": 10080,
      "Lifecycle": {
        "DeleteAfterDays": 30,
        "MoveToColdStorageAfterDays": 7
      },
      "RecoveryPointTags": {
        "BackupType": "Automated"
      }
    }]
  }'

Analytics Integration

  • EMR: Shared data storage for big data processing
  • SageMaker: Machine learning dataset storage
  • Athena: Query data directly from EFS
  • Glue: ETL job data storage

Security Considerations

Encryption

  1. Encryption at Rest
  2. AWS KMS integration
  3. Customer-managed keys
  4. Automatic key rotation

  5. Regional key management

  6. Encryption in Transit

  7. TLS 1.2 encryption
  8. EFS utilities integration
  9. Stunnel for legacy clients
  10. Certificate management
# Mount with encryption in transit
sudo mount -t efs -o tls fs-12345678:/ /mnt/efs

# Mount with access point and encryption
sudo mount -t efs -o tls,accesspoint=fsap-12345678 fs-12345678:/ /mnt/app

Access Control

  1. IAM Policies 

    {
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "elasticfilesystem:DescribeFileSystems",
      "elasticfilesystem:DescribeAccessPoints"
    ],
    "Resource": "*"
  }, {
    "Effect": "Allow",
    "Action": [
      "elasticfilesystem:CreateAccessPoint",
      "elasticfilesystem:DeleteAccessPoint"
    ],
    "Resource": "arn:aws:elasticfilesystem:*:*:file-system/fs-12345678"
  }]
}

  2. Resource-Based Policies 

    {
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::account:root"
    },
    "Action": [
      "elasticfilesystem:ClientMount",
      "elasticfilesystem:ClientWrite"
    ],
    "Resource": "*",
    "Condition": {
      "Bool": {
        "aws:SecureTransport": "true"
      }
    }
  }]
}

  3. VPC Security

  4. Security groups for mount targets
  5. Network ACLs
  6. VPC endpoints
  7. Private subnet deployment

EFS Access Points

# Create access point with IAM integration
aws efs create-access-point \
  --file-system-id fs-12345678 \
  --posix-user Uid=1000,Gid=1000 \
  --root-directory Path="/restricted",CreationInfo='{
    "OwnerUid": 1000,
    "OwnerGid": 1000,
    "Permissions": "755"
  }' \
  --policy '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::account:user/developer"},
      "Action": "elasticfilesystem:ClientMount",
      "Resource": "*"
    }]
  }'

Monitoring and Troubleshooting

CloudWatch Metrics

File System Metrics

  • TotalIOBytes: Total bytes for file system operations
  • DataReadIOBytes/DataWriteIOBytes: Data transfer metrics
  • ClientConnections: Number of client connections
  • StorageBytes: Amount of storage used by storage class
  • BurstCreditBalance: Available burst credits

Performance Metrics

  • TotalIOTime: Total time for file system operations
  • PercentIOLimit: Percentage of I/O limit used
  • ThroughputUtilization: Percentage of throughput used
  • MetadataIOBytes: Metadata operation bytes

Monitoring Setup

# Create CloudWatch alarm for burst credits
aws cloudwatch put-metric-alarm \
  --alarm-name "EFS-Low-Burst-Credits" \
  --alarm-description "EFS burst credit balance is low" \
  --metric-name BurstCreditBalance \
  --namespace AWS/EFS \
  --statistic Average \
  --period 300 \
  --threshold 1000000 \
  --comparison-operator LessThanThreshold \
  --dimensions Name=FileSystemId,Value=fs-12345678

# Monitor storage utilization
aws cloudwatch get-metric-statistics \
  --namespace AWS/EFS \
  --metric-name StorageBytes \
  --dimensions Name=FileSystemId,Value=fs-12345678 Name=StorageClass,Value=Standard \
  --start-time 2023-01-01T00:00:00Z \
  --end-time 2023-01-02T00:00:00Z \
  --period 3600 \
  --statistics Average

Common Issues and Solutions

  1. Mount Issues
  2. Verify security group rules (NFS port 2049)
  3. Check subnet routing
  4. Confirm mount target availability

  5. Verify EFS utilities installation

  6. Performance Issues

  7. Monitor burst credit balance
  8. Check throughput mode configuration
  9. Verify client configuration

  10. Consider performance mode change

  11. Permission Issues

  12. Check POSIX permissions
  13. Verify IAM policies
  14. Confirm access point configuration
  15. Review resource-based policies

Troubleshooting Commands

# Check mount status
mount | grep efs

# Verify connectivity to mount target
telnet fs-12345678.efs.region.amazonaws.com 2049

# Check EFS file system status
aws efs describe-file-systems --file-system-id fs-12345678

# Monitor file system performance
aws efs describe-file-systems \
  --file-system-id fs-12345678 \
  --query 'FileSystems[0].ThroughputMode'

# Check access points
aws efs describe-access-points \
  --file-system-id fs-12345678

Exam-Specific Tips and Common Scenarios

Key Exam Topics

  1. Storage Class Selection
  2. Standard vs IA vs Archive trade-offs
  3. One Zone vs Regional considerations
  4. Cost optimization strategies

  5. Lifecycle management policies

  6. Performance Configuration

  7. General Purpose vs Max I/O modes
  8. Bursting vs Provisioned vs Elastic throughput
  9. Performance optimization techniques

  10. Monitoring and troubleshooting

  11. Security and Access Control

  12. Encryption options and requirements
  13. IAM vs resource-based policies
  14. Access Points use cases
  15. VPC security configurations

Common Exam Scenarios

  1. Container Storage
  2. EKS persistent volumes
  3. ECS task storage
  4. Fargate container storage

  5. Docker volume mounting

  6. Multi-AZ Applications

  7. Shared application data
  8. Cross-AZ file access
  9. High availability configurations

  10. Disaster recovery planning

  11. Cost Optimization

  12. Lifecycle policy implementation
  13. Storage class selection
  14. Throughput mode optimization

  15. Regional vs One Zone decisions

  16. Backup and Recovery

  17. AWS Backup integration
  18. Point-in-time recovery
  19. Cross-region backup strategies
  20. Compliance requirements

Exam Tips

  • Know the differences between storage classes and their use cases
  • Understand performance modes and when to use each
  • Remember encryption options and their implications
  • Know integration patterns with EC2, containers, and Lambda
  • Understand cost factors and optimization strategies

Hands-on Examples and CLI Commands

File System Operations

# Create encrypted EFS with lifecycle management
aws efs create-file-system \
  --creation-token production-efs-$(date +%s) \
  --performance-mode generalPurpose \
  --throughput-mode elastic \
  --encrypted \
  --kms-key-id alias/my-efs-key \
  --tags Key=Name,Value=ProductionEFS Key=Environment,Value=Production

# Set lifecycle policy
aws efs put-lifecycle-configuration \
  --file-system-id fs-12345678 \
  --lifecycle-policies \
    TransitionToIA=AFTER_30_DAYS,TransitionToArchive=AFTER_90_DAYS

# Create replication configuration
aws efs create-replication-configuration \
  --source-file-system-id fs-12345678 \
  --destinations Region=us-east-1,KmsKeyId=alias/my-efs-key-east

Mount Target Management

# Create mount targets in multiple subnets
for subnet in subnet-12345678 subnet-87654321 subnet-11111111; do
  aws efs create-mount-target \
    --file-system-id fs-12345678 \
    --subnet-id $subnet \
    --security-groups sg-12345678
done

# Modify mount target security groups
aws efs modify-mount-target-security-groups \
  --mount-target-id fsmt-12345678 \
  --security-groups sg-12345678 sg-87654321

Performance Testing

# Install EFS utilities and fio
sudo yum install -y amazon-efs-utils fio

# Mount EFS with optimal settings
sudo mkdir /mnt/efs-test
sudo mount -t efs -o tls,fsc fs-12345678:/ /mnt/efs-test

# Test sequential write performance
sudo fio --name=efs-sequential-write \
  --ioengine=libaio \
  --iodepth=16 \
  --rw=write \
  --bs=1M \
  --direct=1 \
  --size=1G \
  --numjobs=4 \
  --runtime=60 \
  --group_reporting \
  --directory=/mnt/efs-test

# Test random read performance
sudo fio --name=efs-random-read \
  --ioengine=libaio \
  --iodepth=32 \
  --rw=randread \
  --bs=4k \
  --direct=1 \
  --size=1G \
  --numjobs=4 \
  --runtime=60 \
  --group_reporting \
  --directory=/mnt/efs-test

Application Integration

# Configure EFS for web application
sudo mkdir -p /var/www/shared
sudo mount -t efs -o tls,accesspoint=fsap-12345678 fs-12345678:/ /var/www/shared
sudo chown www-data:www-data /var/www/shared

# Set up automatic mounting
echo 'fs-12345678.efs.region.amazonaws.com:/ /var/www/shared efs tls,accesspoint=fsap-12345678,_netdev 0 0' \
  | sudo tee -a /etc/fstab

This comprehensive EFS documentation covers all essential aspects for AWS certification exams, providing both theoretical knowledge and practical implementation examples.