Ravindra BagaleCourses & study guides मराठी Track your progress

Mount Amazon EFS on EC2 Step by Step

By , trainer LinkedIn Last updated:

Hands-on: create EFS in ap-south-1, open NFS from an EC2 security group, mount with the Amazon EFS mount helper, write a file, and clean up.

What you'll learn in this chapter

  • Create EFS and mount targets
  • Security group for port 2049
  • Mount on Amazon Linux 2023
  • fstab note and full cleanup

Cost

EFS storage is billed while the file system exists. Delete it after the lab. Stop or terminate the EC2 if you created one only for this lab.

1. Lab: click by click

How to do it (step by step)

Region ap-south-1. You need an Amazon Linux 2023 EC2 in a VPC with DNS hostnames enabled (default VPC is fine).

A. Security groups

  1. Create SG efs-lab-sg for EFS. Inbound: NFS TCP 2049 from the EC2 security group (source = EC2 SG id). Outbound: all.
  2. On the EC2 SG: allow SSH from My IP (if you use SSH). Outbound all is enough for mount.

B. Create EFS

  1. Console → EFS → Create file system.
  2. Name: lab-efs. VPC: same as EC2. Customize if needed — one mount target per AZ used by your subnet.
  3. Attach security group efs-lab-sg to mount targets (replace default if it is too open).
  4. Create. Wait until Available. Copy File system ID fs-.........

C. Install mount helper on EC2

  1. SSH to EC2 (or EC2 Instance Connect).
  2. Install:
sudo dnf install -y amazon-efs-utils
# Amazon Linux 2: sudo yum install -y amazon-efs-utils

D. Mount

  1. Make mount point and mount (replace FILE_SYSTEM_ID):
sudo mkdir -p /mnt/efs
sudo mount -t efs -o tls FILE_SYSTEM_ID:/ /mnt/efs
echo "hello from $(hostname)" | sudo tee /mnt/efs/hello.txt
cat /mnt/efs/hello.txt
df -hT | grep efs

Expected: file content prints; df shows type nfs4 or efs.

E. Optional fstab

  1. For reboot persistence (lab optional):
echo "FILE_SYSTEM_ID:/ /mnt/efs efs _netdev,tls 0 0" | sudo tee -a /etc/fstab
sudo umount /mnt/efs && sudo mount -a
df -hT | grep efs

Cleanup

  1. sudo umount /mnt/efs — remove fstab line if added.
  2. EFS console → Delete file system lab-efs (confirm).
  3. Delete efs-lab-sg if unused. Stop/terminate lab EC2.

2. Interview angles

Q. Which port?

TCP 2049 (NFS).

Q. Why source SG not 0.0.0.0/0?

Least privilege — only EC2 SG can mount.

Q. tls mount option?

Encrypts NFS in transit.

Q. Mount helper package?

amazon-efs-utils.

Try at home

  1. Mount the same EFS from a second EC2 and read hello.txt.
  2. Enable EFS Infrequent Access lifecycle (read only — then disable/delete).

In short

  1. EFS + SG 2049 + amazon-efs-utils.
  2. mount -t efs -o tls …
  3. Unmount and delete the file system after labs.

Practice Tasks

About this scenario

Singapore Freight is a logistics business in Singapore. Wei Ling Tan looks after its IT and cloud work. They count money in SGD and run their AWS resources in the ap-southeast-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 10

Easy How many addresses in a /16?

Why: Picking a VPC size needs this count.

What to do: Singapore Freight plans the VPC 10.123.0.0/16. How many IP addresses does it hold in total?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Easy Port for SSH

Why: Security group rules need the right port.

What to do: Which TCP port must the security group open for SSH?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Easy Show where you are

Why: Before you copy or delete anything, you must know which folder you are in.

What to do: Wei Ling Tan logged in to the Singapore Freight server and is not sure which folder the terminal is in. Print the current folder path.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Easy Read-only access to one bucket

Why: Least privilege: give only the actions and the bucket the job needs.

What to do: Write an identity policy that lets the user read objects (s3:GetObject) only in bucket sgfreight-data.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

Easy List all files with details

Why: Hidden files (like .env) and file sizes or owners only show with the right options.

What to do: Show a long listing of every file, including hidden ones, in /var/www/sgfreight.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Use sudo if the job changes system files or users. Click Check answer.

Medium Create an EFS file system

Why: EFS is shared storage that many servers can mount at once.

What to do: Create an encrypted EFS file system with creation token sgfreight-shared.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Storage cost

Why: Storage is billed per GB-month.

What to do: 500 GB in S3 Standard at USD 0.023 per GB-month. Monthly cost in USD?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Medium Usable IPs in an AWS /24 subnet

Why: AWS keeps 5 addresses in every subnet.

What to do: How many addresses can Singapore Freight use for servers in subnet 10.123.1.0/24 on AWS?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Hard Create a mount target

Why: Servers in a subnet reach EFS through a mount target in that AZ.

What to do: Create a mount target for fs-0abc1234 in subnet subnet-01a201dd521abb1 with security group sg-016201cc52164c3b2.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard S3 lifecycle rule (JSON)

Why: Old files move to cheaper storage automatically.

What to do: Write lifecycle JSON: one Enabled rule, prefix logs/, transition to GLACIER after 90 days.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Fill in each property with the value from the task.
  4. Click Check answer. Key order does not matter.

See all practice tasks in the Task Hub →

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

Revision card: NFS security group for EFS. Mount hangs forever when port 2049 is blocked between EC2 and mount targets. Allow inbound NFS (TCP 2049) on the EFS mount-target security group from the EC2 security group (not 0.0.0.0/0 in real apps). EC2 SG egress OK; EFS SG inbound 2049 source = EC2 SG id in the same VPC. sudo mount -t efs -o tls fs-xxxx:/ /mnt/efs succeeds instead of timing out.
Revision card: NFS security group for EFS · Download PNG · Open card page
Revision card: Mount helper and fstab. A manual mount is lost after reboot unless you persist it. Amazon Linux EFS mount helper uses amazon-efs-utils. fstab keeps the mount across reboots. yum/dnf install amazon-efs-utils → mkdir /mnt/efs → mount -t efs -o tls fs-id:/ /mnt/efs → add fstab line with _netdev. After reboot, df -h still shows /mnt/efs and the shared hello.txt.
Revision card: Mount helper and fstab · Download PNG · Open card page
Revision card: Unmount and delete EFS. EFS storage and mount targets keep costing if you only stop the EC2. Unmount on every instance, delete mount targets, then delete the file system. Terminate lab EC2 if you created one. umount /mnt/efs → console delete file system (mount targets first if required) → terminate EC2. EFS console list is empty for the lab FS; Cost Explorer quiet after a day.
Revision card: Unmount and delete EFS · Download PNG · Open card page
Interview card: Which port must EFS security groups allow?. NFS TCP 2049 between EC2 and EFS mount targets. Opening 2049 to the world is unsafe; source the EC2 security group id. EFS SG inbound 2049 from sg-ec2; then mount -t efs succeeds.
Interview card: Which port must EFS security groups allow? · Download PNG · Open card page
Interview card: Why add EFS to fstab?. So the mount returns after reboot without a manual remount. Use _netdev so the system waits for network before mounting NFS. fstab line with efs/_netdev and tls options via amazon-efs-utils guidance.
Interview card: Why add EFS to fstab? · Download PNG · Open card page

More cards: Ravi Sir's Cards.