AWS efs documentation change
Summary
Restructured documentation to focus on mount target creation, added detailed CLI examples, clarified VPC limitations for One Zone file systems, and removed deletion-focused content
Security assessment
Changes focus on procedural clarifications and documentation structure. While security groups are mentioned in CLI examples, this is part of standard configuration rather than addressing a specific security vulnerability. No evidence of patching vulnerabilities or incident response documentation.
Diff
diff --git a/efs/latest/ug/manage-fs-access-create-delete-mount-targets.md b/efs/latest/ug/manage-fs-access-create-delete-mount-targets.md index cf23418b0..0e580bfc5 100644 --- a/efs/latest/ug/manage-fs-access-create-delete-mount-targets.md +++ b/efs/latest/ug/manage-fs-access-create-delete-mount-targets.md @@ -5 +5 @@ -# Creating or deleting mount targets in a VPC +# Creating mount targets @@ -7 +7,3 @@ -To access an Amazon EFS file system in a VPC, you need mount targets. For an Amazon EFS file system, the following is true: +To access an EFS file system in a VPC, you need to create mount targets for the file system. + +For an EFS file system, the following is true: @@ -10,0 +13,2 @@ To access an Amazon EFS file system in a VPC, you need mount targets. For an Ama + * You can create mount targets for the file system in one VPC at a time. If you want to access the file system from another VPC,. you need to delete the mount targets from the current VPC and then create new mount targets in the other VPC. For more information, see [Changing the mount target VPC](./manage-fs-access-change-vpc.html). + @@ -12,0 +17,30 @@ To access an Amazon EFS file system in a VPC, you need mount targets. For an Ama + * At a minimum, you should create a mount target in each Availability Zone from which you want to access the file system. + + + + +###### Note + +We recommend that you create a mount target in each of the Availability Zones. There are cost considerations for mounting a file system on an EC2 instance in an Availability Zone through a mount target created in another Availability Zone. For more information, see [Amazon EFS Pricing](https://aws.amazon.com/efs/pricing). In addition, by always using a mount target local to the instance's Availability Zone, you remove a partial failure scenario. If the mount target's zone goes down, you can't access your file system through that mount target. + +You can create mount targets for a file system by using the AWS Management Console, AWS CLI, or programmatically by using the AWS SDKs. In the console, you can create mount targets when you create the file system or after the file system is created. For instructions on creating mount targets when creating a file system, see [Custom using the console](./creating-using-create-fs.html#creating-using-fs-part1-console). + +Use the following procedure to add mount targets to an existing EFS file system. + +###### To create a mount target on an EFS file system + + 1. Open the Amazon Elastic File System console at [https://console.aws.amazon.com/efs/](https://console.aws.amazon.com/efs/). + + 2. In the left navigation pane, choose **File systems** , and then select the file system for which you want to change the VPC. + + 3. Choose **Network** and then choose **Manage** to display the mount targets for the file system. + + 4. Choose the file system that you want to add mount targets for by choosing its **Name** or the **File system ID**. + +###### Note + +For One Zone file systems, you can only create a single mount target that is in the same Availability Zone as the file system. + + 5. To add a mount target, choose **Add mount target**. This option is available only for file systems that use EFS Regional storage classes, and if mount targets do not already exist in each Availability Zone for the AWS Region. + + 6. For each mount target that you want to create for the file system: @@ -13,0 +48 @@ To access an Amazon EFS file system in a VPC, you need mount targets. For an Ama + 1. Choose **Add mount target**. @@ -14,0 +50,3 @@ To access an Amazon EFS file system in a VPC, you need mount targets. For an Ama + 2. Choose the Availability Zone and subnet ID for the mount target. + + 3. Provide an IP address from the subnet where you are placing the mount target. If you omit a value, Amazon EFS selects an unused IP address from that subnet. @@ -18 +56,5 @@ To access an Amazon EFS file system in a VPC, you need mount targets. For an Ama -We recommend that you create a mount target in each of the Availability Zones. There are cost considerations for mounting a file system on an EC2 instance in an Availability Zone through a mount target created in another Availability Zone. For more information, see [Amazon EFS](https://aws.amazon.com/efs/). In addition, by always using a mount target local to the instance's Availability Zone, you remove a partial failure scenario. If the mount target's zone goes down, you can't access your file system through that mount target. +You can't change the IP address of a mount target after it's created. To change an IP address, you need to delete the mount target and create a new one with the new address. + + 7. Choose **Save**. + + @@ -20 +61,0 @@ We recommend that you create a mount target in each of the Availability Zones. T -If you delete a mount target, the operation forcibly breaks any mounts of the file system, which might disrupt instances or applications using those mounts. To avoid application disruption, stop applications and unmount the file system before deleting the mount target. For more information, see [Managing mount targets](./accessing-fs.html). @@ -24 +65,34 @@ If you delete a mount target, the operation forcibly breaks any mounts of the fi -Before deleting a mount target, first unmount the file system. For more information, see [Unmounting file systems](./unmounting-fs.html). +For One Zone file systems, you can only create a single mount target that is in the same Availability Zone as the file system. + +###### To create a mount target (CLI) + + * To create a mount target, use the `create-mount-target` CLI command (corresponding operation is [CreateMountTarget](./API_CreateMountTarget.html)), as shown following. + + $ aws efs create-mount-target \ + --file-system-id file-system-id \ + --subnet-id subnet-id \ + --security-group ID-of-the-security-group-created-for-mount-target \ + --region aws-region \ + --profile adminuser + +The following example shows the command with sample data. + + $ aws efs create-mount-target \ + --file-system-id fs-0123467 \ + --subnet-id subnet-b3983dc4 \ + --security-group sg-01234567 \ + --region us-east-2 \ + --profile adminuser + +After successfully creating the mount target, Amazon EFS returns the mount target description as JSON as shown in the following example. + + { + "MountTargetId": "fsmt-f9a14450", + "NetworkInterfaceId": "eni-3851ec4e", + "FileSystemId": "fs-b6a0451f", + "LifeCycleState": "available", + "SubnetId": "subnet-b3983dc4", + "OwnerId": "23124example", + "IpAddress": "10.0.1.24" + } + @@ -26 +99,0 @@ Before deleting a mount target, first unmount the file system. For more informat -You can use a file system only in one VPC at a time. That is, you can create mount targets for the file system in one VPC at a time. If you want to access the file system from another VPC, first delete the mount targets from the current VPC. Then create new mount targets in another VPC. @@ -28 +100,0 @@ You can use a file system only in one VPC at a time. That is, you can create mou -Using the AWS Management Console, the AWS CLI, and the API, you can create and manage mount targets on file systems. For existing mount targets, you can add and remove security groups, or delete the mount target. For more information, see [Managing mount targets](./accessing-fs.html). @@ -38 +110 @@ Managing mount targets -Changing the VPC for your mount target +Deleting mount targets