AWS efs documentation change
Summary
Restructured documentation about mount targets, removed detailed CLI command examples, added topic sections for managing mount targets, and reorganized content about Availability Zones and security groups.
Security assessment
Changes focus on content reorganization and removal of CLI examples rather than addressing security vulnerabilities. While security groups are mentioned as part of mount target configuration, this is existing functionality rather than new security documentation or fixes.
Diff
diff --git a/efs/latest/ug/accessing-fs.md b/efs/latest/ug/accessing-fs.md index 6bc858ff1..4e4159a8b 100644 --- a/efs/latest/ug/accessing-fs.md +++ b/efs/latest/ug/accessing-fs.md @@ -5,49 +5 @@ -# Managing mount targets - -You mount your file system on Amazon EC2 or other AWS compute instance in your virtual private cloud (VPC) using a mount target that you create for the file system. Managing file system network accessibility refers to managing a file system's mount targets. - -After you create an Amazon EFS file system, you can create mount targets. For Amazon EFS file systems that use Regional storage classes, you can create a mount target in each Availability Zone in an AWS Region. For One Zone file systems, you can only create a single mount target in the same Availability Zone as the file system. Then you can mount the file system on compute instances, including Amazon EC2, Amazon ECS, and AWS Lambda in your virtual private cloud (VPC). - -The following diagram shows a Regional file system with mount targets created in all Availability Zones in the VPC. The illustration shows three EC2 instances launched in different VPC subnets accessing an EFS file system. The illustration also shows one mount target in each of the Availability Zones (regardless of the number of subnets in each Availability Zone). - -You can create only one mount target per Availability Zone. If an Availability Zone has multiple subnets, as shown in one of the zones in the illustration, you create a mount target in only one of the subnets. As long as you have one mount target in an Availability Zone, the EC2 instances launched in any of its subnets can share the same mount target. - - - -The following diagram shows a One Zone file system, with a single mount target created in the same Availability Zone as the file system. Accessing the file system by using the EC2 instance in the `us-west2c` Availability Zone incurs data access charges because it is located in a different Availability Zone than the mount target. - - - -The mount target security group acts as a virtual firewall that controls the traffic. For example, it determines which clients can access the file system. This section explains the following: - - * Managing mount target security groups and enabling traffic. - - * Mounting the file system on your clients. - - * NFS-level permissions considerations. - -Initially, only the root user on the Amazon EC2 instance has read-write-execute permissions on the file system. This topic discusses NFS-level permissions and provides examples that show you how to grant permissions in common scenarios. For more information, see [Network File System (NFS) level users, groups, and permissions](./accessing-fs-nfs-permissions.html). - - - - -Managing mount targets refers to these activities: - - * **Creating and deleting mount targets in a VPC** – At a minimum, you should create a mount target in each Availability Zone from which you want to access the file system. - - * **Updating the mount target configuration** – When you create a mount target, you associate security groups with the mount target. A security group acts as a virtual firewall that controls the traffic to and from the mount target. You can add inbound rules to control access to the mount target, and thus the file system. After creating a mount target, you might want to modify the security groups assigned to them. - - - - -You can create mount targets for a file system by using the AWS Management Console, AWS CLI, or programmatically by using the AWS SDKs. When you're using the console, you can create mount targets when you first create a file system or after the file system is created. For instructions to create mount targets by using the Amazon EFS console when creating a file system, see [Create a file system with custom settings (console)](./creating-using-create-fs.html#creating-using-fs-part1-console). - -Use the following procedure to add or modify mount targets for an existing Amazon EFS file system. - -###### To manage mount targets on an Amazon EFS file system - - 1. Sign in to the AWS Management Console and open the Amazon EFS console at [ https://console.aws.amazon.com/efs/](https://console.aws.amazon.com/efs/). - - 2. In the left navigation pane, choose **File systems**. The **File systems** page displays the EFS file systems in your account. - - 3. Choose the file system that you want to manage mount targets for by choosing its **Name** or the **File system ID** to display the file system details page. +Mount targets and Availability Zones @@ -55,11 +7 @@ Use the following procedure to add or modify mount targets for an existing Amazo - 4. Choose **Network** to display the list of existing mount targets. - - 5. Choose **Manage** to display the **Availability Zone** page and make modifications. - -On this page, for existing mount targets, you can add and remove security groups, or delete the mount target. You can also create new mount targets. - -###### Note - -For One Zone file systems, you can only create a single mount target that is in the same Availability Zone as the file system. - - * To remove a security group from a mount target, choose **X** next to the security group ID. +# Managing mount targets @@ -67 +9 @@ For One Zone file systems, you can only create a single mount target that is in - * To add a security group to a mount target, choose **Select security groups** to display a list of available security groups. Or, enter a security group ID in the search field at the top of the list. +You mount your file system on Amazon EC2 or other AWS compute instance in your virtual private cloud (VPC) using one or more mount targets that you create for the file system. You can create the mount target when you create the file system or after you create the file system. @@ -69 +11 @@ For One Zone file systems, you can only create a single mount target that is in - * To queue a mount target for deletion, choose **Remove**. +After a mount target is created for a file system, you can create additional mount targets, delete mount targets, and modify the security groups for mount targets. If you want to modify the VPC for mount targets, then you need to first delete the existing mount targets. @@ -73,22 +15 @@ For One Zone file systems, you can only create a single mount target that is in -Before deleting a mount target, first unmount the file system. - - * To add a mount target, choose **Add mount target**. This option is available only for file systems that use EFS Regional storage classes, and if mount targets do not already exist in each Availability Zone for the AWS Region. - - 6. Choose **Save** to save any changes. - - - - -###### To change the VPC for an Amazon EFS file system (console) - -To change the VPC for a file system's network configuration, you must delete all of the file system's existing mount targets. - - 1. Open the Amazon Elastic File System console at [https://console.aws.amazon.com/efs/](https://console.aws.amazon.com/efs/). - - 2. In the left navigation pane, choose **File systems**. The **File systems** page shows the EFS file systems in your account. - - 3. For the file system that you want to change the VPC for, choose the **Name** or the **File system ID**. The file system details page is displayed. - - 4. Choose **Network** to display the list of existing mount targets. - - 5. Choose **Manage**. The **Availability Zone** page appears. +You can't change the IP address of an existing mount target. To change an IP address, you need to delete the mount target and create a new one with the new address. @@ -96 +17 @@ To change the VPC for a file system's network configuration, you must delete all - 6. Remove all mount targets displayed on the page. +###### Topics @@ -98 +19 @@ To change the VPC for a file system's network configuration, you must delete all - 7. Choose **Save** to save changes and delete the mount targets. The **Network** tab shows the mount targets status as **deleting**. + * Mount targets and Availability Zones @@ -100 +21 @@ To change the VPC for a file system's network configuration, you must delete all - 8. When all the mount targets statuses show as **deleted** , choose **Manage**. The **Availability Zone** page appears. + * [Creating mount targets](./manage-fs-access-create-delete-mount-targets.html) @@ -102 +23 @@ To change the VPC for a file system's network configuration, you must delete all - 9. Choose the new VPC from the **Virtual Private Cloud (VPC)** list. + * [Deleting mount targets](./mount-target-delete.html) @@ -104 +25 @@ To change the VPC for a file system's network configuration, you must delete all - 10. Choose **Add mount target** to add a new mount target. For each mount target you add, enter the following: + * [Changing the mount target VPC](./manage-fs-access-change-vpc.html) @@ -106 +27 @@ To change the VPC for a file system's network configuration, you must delete all - * An **Availability Zone** + * [Changing mount target security groups](./manage-fs-access-update-mount-target-config-sg.html) @@ -108 +28,0 @@ To change the VPC for a file system's network configuration, you must delete all - * A **Subnet ID** @@ -110 +29,0 @@ To change the VPC for a file system's network configuration, you must delete all - * An **IP address** , or keep it set to **Automatic** @@ -112 +30,0 @@ To change the VPC for a file system's network configuration, you must delete all - * One or more **Security groups** @@ -114 +32 @@ To change the VPC for a file system's network configuration, you must delete all - 11. Choose **Save** to implement the VPC and mount target changes. +## Mount targets and Availability Zones @@ -115,0 +34 @@ To change the VPC for a file system's network configuration, you must delete all +For EFS file systems that use Regional storage classes, you can create a mount target in each Availability Zone in an AWS Region. @@ -116,0 +36 @@ To change the VPC for a file system's network configuration, you must delete all +For One Zone file systems, you can only create a single mount target in the same Availability Zone as the file system. Then you can mount the file system on compute instances, including Amazon EC2, Amazon ECS, and AWS Lambda in your virtual private cloud (VPC). @@ -117,0 +38 @@ To change the VPC for a file system's network configuration, you must delete all +The following diagram shows a Regional file system with mount targets created in all Availability Zones in the VPC. The illustration shows three EC2 instances launched in different VPC subnets accessing an EFS file system. The illustration also shows one mount target in each of the Availability Zones (regardless of the number of subnets in each Availability Zone). @@ -119,104 +40 @@ To change the VPC for a file system's network configuration, you must delete all -###### Note - -For One Zone file systems, you can only create a single mount target that is in the same Availability Zone as the file system. - -###### To create a mount target (CLI) - - * To create a mount target, use the `create-mount-target` CLI command (corresponding operation is [CreateMountTarget](./API_CreateMountTarget.html)), as shown following. - - $ aws efs create-mount-target \ - --file-system-id file-system-id \ - --subnet-id subnet-id \ - --security-group ID-of-the-security-group-created-for-mount-target \ - --region aws-region \ - --profile adminuser - -The following example shows the command with sample data. - - $ aws efs create-mount-target \ - --file-system-id fs-0123467 \ - --subnet-id subnet-b3983dc4 \ - --security-group sg-01234567 \ - --region us-east-2 \ - --profile adminuser - -After successfully creating the mount target, Amazon EFS returns the mount target description as JSON as shown in the following example. - - { - "MountTargetId": "fsmt-f9a14450", - "NetworkInterfaceId": "eni-3851ec4e", - "FileSystemId": "fs-b6a0451f", - "LifeCycleState": "available", - "SubnetId": "subnet-b3983dc4", - "OwnerId": "23124example", - "IpAddress": "10.0.1.24" - } - - - - -###### To retrieve a list of mount targets for a file system (CLI) - - * You can also retrieve a list of mount targets created for a file system by using the [describe-mount-targets](https://docs.aws.amazon.com/cli/latest/reference/efs/describe-mount-targets.html) CLI command (the corresponding operation is [DescribeMountTargets](./API_DescribeMountTargets.html)), as shown following. - - $ aws efs describe-mount-targets --file-system-id fs-a576a6dc - - { - "MountTargets": [ - { - "OwnerId": "111122223333", - "MountTargetId": "fsmt-48518531", - "FileSystemId": "fs-a576a6dc", - "SubnetId": "subnet-88556633", - "LifeCycleState": "available", - "IpAddress": "172.31.25.203", - "NetworkInterfaceId": "eni-0123456789abcdef1", - "AvailabilityZoneId": "use2-az2", - "AvailabilityZoneName": "us-east-2b" - }, - { - "OwnerId": "111122223333", - "MountTargetId": "fsmt-5651852f", - "FileSystemId": "fs-a576a6dc", - "SubnetId": "subnet-44223377", - "LifeCycleState": "available", - "IpAddress": "172.31.46.181", - "NetworkInterfaceId": "eni-0123456789abcdefa", - "AvailabilityZoneId": "use2-az3", - "AvailabilityZoneName": "us-east-2c"