AWS efs documentation change
Summary
Updated mount target creation steps to include explicit security group association and revised CLI examples
Security assessment
Added requirement to associate at least one security group during mount target creation. Security groups are fundamental to network access control, but there's no indication this change addresses a specific vulnerability.
Diff
diff --git a/efs/latest/ug/manage-fs-access-create-delete-mount-targets.md b/efs/latest/ug/manage-fs-access-create-delete-mount-targets.md index 0e580bfc5..04096c8fe 100644 --- a//efs/latest/ug/manage-fs-access-create-delete-mount-targets.md +++ b//efs/latest/ug/manage-fs-access-create-delete-mount-targets.md @@ -13 +13 @@ For an EFS file system, the following is true: - * You can create mount targets for the file system in one VPC at a time. If you want to access the file system from another VPC,. you need to delete the mount targets from the current VPC and then create new mount targets in the other VPC. For more information, see [Changing the mount target VPC](./manage-fs-access-change-vpc.html). + * You can create mount targets for the file system in one VPC at a time. If you want to access the file system from another VPC, you need to delete the mount targets from the current VPC and then create new mount targets in the other VPC. For more information, see [Changing the mount target VPC](./manage-fs-access-change-vpc.html). @@ -44 +44 @@ For One Zone file systems, you can only create a single mount target that is in - 5. To add a mount target, choose **Add mount target**. This option is available only for file systems that use EFS Regional storage classes, and if mount targets do not already exist in each Availability Zone for the AWS Region. + 5. For file systems that use EFS Regional storage classes, choose **Add mount target** for each mount target you want to create for the file system. @@ -46 +46 @@ For One Zone file systems, you can only create a single mount target that is in - 6. For each mount target that you want to create for the file system: + 6. Define the mount target settings: @@ -48 +48 @@ For One Zone file systems, you can only create a single mount target that is in - 1. Choose **Add mount target**. + 1. Choose the Availability Zone and subnet ID for the mount target. @@ -50,3 +50 @@ For One Zone file systems, you can only create a single mount target that is in - 2. Choose the Availability Zone and subnet ID for the mount target. - - 3. Provide an IP address from the subnet where you are placing the mount target. If you omit a value, Amazon EFS selects an unused IP address from that subnet. + 2. Provide an IP address from the subnet where you are placing the mount target. If you omit a value, Amazon EFS selects an unused IP address from that subnet. @@ -58 +56,4 @@ You can't change the IP address of a mount target after it's created. To change - 7. Choose **Save**. + 7. Choose at least one security group to associate with the mount target. You can [modify the security groups](./manage-fs-access-update-mount-target-config-sg.html) later. + + 8. Choose **Save**. + @@ -61,0 +63 @@ You can't change the IP address of a mount target after it's created. To change +This section provides an example for creating a mount target in the AWS CLI using the `create-mount-target` command. The equivalent API command is [CreateMountTarget](./API_CreateMountTarget.html). @@ -67 +69 @@ For One Zone file systems, you can only create a single mount target that is in -###### To create a mount target (CLI) +The following command specifies the file system, subnet, and security group for the mount target. The target is created at an available IP address on the specified subnet. @@ -69 +70,0 @@ For One Zone file systems, you can only create a single mount target that is in - * To create a mount target, use the `create-mount-target` CLI command (corresponding operation is [CreateMountTarget](./API_CreateMountTarget.html)), as shown following. @@ -76 +76,0 @@ For One Zone file systems, you can only create a single mount target that is in - --profile adminuser @@ -81 +82 @@ The following example shows the command with sample data. - --file-system-id fs-0123467 \ + --file-system-id fs-0123456789abcdef1 \ @@ -85 +85,0 @@ The following example shows the command with sample data. - --profile adminuser @@ -89,0 +91 @@ After successfully creating the mount target, Amazon EFS returns the mount targe + "OwnerID": "111122223333" @@ -91,3 +93 @@ After successfully creating the mount target, Amazon EFS returns the mount targe - "NetworkInterfaceId": "eni-3851ec4e", - "FileSystemId": "fs-b6a0451f", - "LifeCycleState": "available", + "FileSystemId": "fs-0123456789abcdef1", @@ -95,2 +95,6 @@ After successfully creating the mount target, Amazon EFS returns the mount targe - "OwnerId": "23124example", - "IpAddress": "10.0.1.24" + "LifeCycleState": "available", + "IpAddress": "10.0.1.24", + "NetworkInterfaceId": "eni-3851ec4e", + "AvailabilityZoneId": "use2-az1", + "AvailabilityZoneName": "us-east-2a", + "VpcId": "vpc-3c39ef57"