Create and Secure an Amazon EFS File System – SAP-C02 Study Guide

Purpose of This Lesson

This hands-on lesson demonstrates how to create an Amazon Elastic File System (Amazon EFS) file system, connect to it from EC2 instances in different Availability Zones, and enforce encryption in transit.

The lab highlights several important EFS design points:

• EFS is a regional, shared file system.
• EC2 instances access EFS using the NFS protocol.
• Mount targets provide network access to the file system from specific Availability Zones.
• Security groups control access to the mount targets.
• The standard NFS client does not support EFS’s TLS mount option; the AWS-provided amazon-efs-utils package is required.

Key Concepts

Amazon EFS architecture

Amazon EFS provides elastic, shared file storage for Linux-based workloads. Multiple EC2 instances can mount the same file system and read or write the same files concurrently.

For a Regional EFS file system, mount targets are created in selected Availability Zones within a VPC. Applications normally mount EFS through the mount target in their own Availability Zone. This helps avoid unnecessary cross-Availability Zone traffic and supports resilient access when instances are distributed across zones.

A mount target has network characteristics including:

• A subnet and Availability Zone
• A private IP address
• A security group
• Connectivity to the EFS file system

The file system itself is regional, while mount targets provide zonal network entry points.

EFS security groups

EFS access requires security group rules on the mount targets. The relevant rule is:

• Protocol: TCP
• Port: 2049
• Source: The security group attached to the client EC2 instances

Port 2049 is the standard NFS port. Referencing the client security group instead of an IP range is generally preferable because access follows the identity of the workload rather than fixed addresses.

The EC2 instances also need outbound connectivity to the mount targets. In a typical configuration, the default outbound rule permits this traffic.

SSH access is separate from EFS access. TCP port 22 is used to administer the instances and should not normally be open to 0.0.0.0/0 in a production environment. Restrict SSH to a trusted administrative CIDR, bastion host, Systems Manager, or another controlled access path.

Mounting EFS with NFS

A client can mount EFS using the file system’s DNS name, for example:

file-system-id.efs.region.amazonaws.com:/

The DNS name resolves to an appropriate mount target address when the VPC and DNS configuration are correct.

A basic NFS mount can provide connectivity, but it does not by itself satisfy a requirement to enforce encryption in transit. If the EFS file system policy requires encrypted transport, a regular NFS mount attempt can fail with an access-denied error.

Encryption at rest versus encryption in transit

These are separate controls:

• Encryption at rest: Protects stored EFS data. EFS supports AWS Key Management Service (AWS KMS) keys for this purpose, and encryption at rest is enabled during file system creation.
• Encryption in transit: Protects data moving between the client and EFS. EFS uses TLS for this connection.

Enabling encryption at rest does not automatically mean that client traffic is encrypted in transit.

amazon-efs-utils and TLS mounts

The AWS-provided amazon-efs-utils package includes the EFS mount helper. It supports the EFS-specific mount type and TLS, commonly used with a command conceptually similar to:

sudo mount -t efs -o tls file-system-id:/ /mnt/efs

The exact command and package installation method depend on the operating system. On Amazon Linux, the package is commonly installed through the system package manager.

The important distinction is the use of:

• The EFS mount helper, rather than only the generic NFS client
• The tls mount option to encrypt traffic in transit

EFS file system policies

EFS supports resource-based file system policies. These policies can control actions such as mounting the file system and can require clients to use secure transport.

A policy that enforces encryption in transit means that clients must mount EFS using TLS. A client using an unsupported or non-TLS mount method will be denied, even if networking and security group rules are otherwise correct.

Exam-Relevant Takeaways

• Amazon EFS is shared file storage intended for concurrent access from multiple compute clients.
• A Regional EFS file system should normally have mount targets in the Availability Zones where clients run.
• EFS uses NFS and TCP port 2049.
• EFS mount target security groups should allow inbound NFS from the application or client security group.
• Security group references are usually more maintainable than broad CIDR-based rules for workload-to-workload access.
• Encryption at rest and encryption in transit are independent requirements.
• Enforcing TLS in an EFS file system policy requires clients to use the EFS mount helper with the TLS option.
• A generic NFS mount can fail after a policy begins requiring encrypted transport.
• A Regional file system and a One Zone file system have different Availability Zone and resilience characteristics. One Zone can be appropriate for certain cost-sensitive workloads, but it does not provide the same multi-AZ storage resilience as Regional EFS.
• EFS configuration is not complete until network routing, DNS resolution, mount target placement, security groups, and client mount options are all correct.

Architecture Decision Guide

Requirement	Recommended EFS approach	Important consideration
Shared files from EC2 instances in multiple Availability Zones	Regional EFS with mount targets in the required AZs	Place clients and mount targets appropriately to avoid unnecessary cross-AZ access
Linux workloads requiring a shared POSIX-style file system	Amazon EFS	Confirm application compatibility with NFS semantics and concurrent access
NFS access restricted to application instances	Allow TCP 2049 from the application security group	Avoid broad inbound CIDR ranges where possible
Data encrypted while stored	Enable EFS encryption at rest	Select the appropriate AWS KMS key during creation
Data encrypted between EC2 and EFS	Use amazon-efs-utils with tls	A generic NFS mount is insufficient when TLS is enforced
Lower-cost file storage limited to one AZ	Consider EFS One Zone	Accept reduced Availability Zone resilience and assess backup/recovery requirements
Strict client-level authorization	Combine IAM authorization, EFS file system policies, and access points where appropriate	Network access alone does not provide complete authorization

Common Exam Traps

• Confusing EFS with EBS: EBS is block storage generally attached to a single EC2 instance at a time within an AZ. EFS is shared file storage accessed over the network.
• Assuming EFS is automatically accessible from every subnet: Clients need network reachability to an EFS mount target, and mount targets must exist in the required Availability Zones.
• Opening port 2049 to the internet: EFS should normally be accessed privately from authorized VPC clients.
• Using port 22 for EFS: SSH is unrelated to NFS. EFS uses TCP 2049.
• Treating encryption at rest as encryption in transit: KMS-backed at-rest encryption does not secure the network connection.
• Using the generic NFS client after requiring TLS: A policy requiring secure transport needs the EFS mount helper and the tls option.
• Assuming a security group alone enforces TLS: Security groups control network reachability; the EFS file system policy and client mount configuration address transport enforcement.
• Forgetting mount target placement: A file system can exist successfully while a client still cannot mount it because the required mount target, route, DNS resolution, or security group rule is missing.
• Leaving administrative SSH open to 0.0.0.0/0: This may work in a temporary lab but is an unsafe production pattern.

Real-World Engineer Notes

• Use separate security groups for application clients and storage mount targets when that makes the trust boundary clearer. Permit inbound TCP 2049 on the EFS mount-target security group from the client security group.
• Prefer AWS Systems Manager Session Manager or a controlled bastion path over unrestricted public SSH for administration.
• EFS DNS resolution depends on VPC DNS support and DNS hostnames being enabled. Validate those settings when mounts fail unexpectedly.
• Use EFS access points to provide application-specific entry directories, POSIX identities, and a more controlled namespace. This is often safer than giving every application access to the file system root.
• Test concurrent file access and locking behavior with the actual application. Shared storage does not eliminate application-level consistency or coordination concerns.
• Choose EFS throughput and performance settings based on workload behavior rather than assuming the defaults are optimal. Monitor throughput, burst behavior, and client performance.
• For production deployments, create mount targets through infrastructure as code and place them consistently across the Availability Zones used by the workload.
• Clean up test instances, mount targets, and file systems after a lab. EFS and related resources can continue generating charges after the test is complete.

Quick Reference Summary

• Service: Amazon Elastic File System (Amazon EFS)
• Storage type: Managed, shared, elastic file storage
• Protocol: NFS
• NFS port: TCP 2049
• Network entry point: EFS mount target
• Recommended source rule: Client EC2 security group
• At-rest encryption: AWS KMS-backed EFS encryption
• In-transit encryption: TLS through amazon-efs-utils and the tls mount option
• Policy capability: EFS resource-based file system policies
• Regional design: Use mount targets in the Availability Zones containing clients
• Key troubleshooting areas: DNS, routes, mount targets, security groups, NFS port, client package, and TLS policy requirements

Flashcards

1. Q: What protocol does Amazon EFS use for client access?

A: NFS.

1. Q: Which port must be allowed for normal EFS NFS access?

A: TCP port 2049.

1. Q: What is the purpose of an EFS mount target?

A: It provides a network-accessible endpoint in a subnet and Availability Zone for clients to connect to the EFS file system.

1. Q: What source should commonly be permitted in an EFS mount target security group?

A: The security group attached to authorized client instances or workloads.

1. Q: Does EFS encryption at rest encrypt traffic between EC2 and EFS?

A: No. Encryption at rest protects stored data; TLS is required for encryption in transit.

1. Q: Which package provides the AWS EFS mount helper and TLS support?

A: amazon-efs-utils.

1. Q: What mount option enables EFS TLS encryption in transit?

A: tls.

1. Q: What may happen when a file system policy enforces encryption in transit but the client uses a generic NFS mount?

A: The mount can be rejected, often with an access-denied error.

1. Q: Why create EFS mount targets in multiple Availability Zones?

A: To provide zonal access paths and support workloads distributed across those Availability Zones.

1. Q: How does EFS differ from EBS in access model?

A: EFS is shared file storage accessed over NFS; EBS is block storage typically attached to an EC2 instance within one Availability Zone.

1. Q: What AWS feature can provide an application-specific EFS directory and POSIX identity?

A: An EFS access point.

1. Q: What is the security role of an EFS file system policy?

A: It provides resource-based authorization controls, including the ability to require secure transport.

Practice Questions

Question 1

A company runs Linux application instances in two Availability Zones. Both groups of instances must read and write the same files. The architect wants a managed service that supports shared access without manually managing file servers. Which solution is most appropriate?

A. Create one EBS volume and attach it to all instances.
B. Create a Regional EFS file system with mount targets in both Availability Zones.
C. Create an instance store volume on each instance and replicate files manually.
D. Create an S3 bucket and mount it using a generic NFS client.

Correct answer: B

A Regional EFS file system provides shared file access and can be reached through mount targets in multiple Availability Zones. A standard EBS volume is not a general-purpose multi-instance shared file system, and instance store is ephemeral. S3 is object storage and does not provide native POSIX file-system semantics by itself.

Question 2

An EFS file system security group permits inbound TCP 2049 from the application instances’ security group. The application still cannot mount the file system. The instances are in an Availability Zone where no EFS mount target exists. What should the architect do?

A. Permit inbound TCP port 22 from the application instances.
B. Create an EFS mount target in the Availability Zone and subnet used by the clients.
C. Replace EFS with an encrypted EBS volume.
D. Add an internet gateway route to the subnet.

Correct answer: B

The clients need a reachable EFS mount target. TCP 22 is SSH, not NFS, and EFS should normally be accessed through private VPC connectivity rather than an internet gateway.

Question 3

A security requirement states that all EFS client traffic must be encrypted in transit. An administrator adds an EFS file system policy enforcing secure transport. Existing clients using a regular NFS mount can no longer connect. What is the correct remediation?

A. Allow TCP 22 in the EFS security group.
B. Enable EFS encryption at rest only.
C. Install amazon-efs-utils and mount the file system using the tls option.
D. Add the file system ID to the EC2 instance’s user data without changing the mount command.

Correct answer: C

The policy requires encrypted transport. The EFS mount helper supplied by amazon-efs-utils supports TLS mounting. Encryption at rest and SSH rules do not satisfy this requirement.

Question 4

An engineer wants to restrict EFS access to EC2 instances belonging to a specific application tier. Which security group design best implements the network portion of this requirement?

A. Allow TCP 2049 from 0.0.0.0/0.
B. Allow TCP 2049 from the application tier’s security group.
C. Allow TCP 2049 only from the EFS mount target’s own private IP address.
D. Allow TCP 22 from the application tier’s security group.

Correct answer: B

A security group reference allows authorized instances in the application tier to reach EFS while avoiding a broad CIDR rule. TCP 2049 is the required NFS port; port 22 is used for SSH administration.

Question 5

A workload requires shared Linux file storage across Availability Zones and also requires protection against an Availability Zone failure. Which EFS option is generally the better fit?

A. EFS One Zone with a single mount target.
B. Regional EFS with mount targets in the Availability Zones used by the workload.
C. An unencrypted local instance store volume.
D. A single EBS volume in one Availability Zone attached to all instances.

Correct answer: B

Regional EFS is designed for multi-Availability Zone access and resilience. One Zone has a narrower failure domain, while instance store and a single-AZ EBS design do not meet the stated resilience requirement.