AWS efs documentation change
Summary
Restructured documentation to clarify configuration options for EFS file system creation, added details about preconfigured security policies (prevent root access, enforce read-only, prevent anonymous access, enforce in-transit encryption), and reorganized settings explanations into a table format with recommended values.
Security assessment
The changes add documentation about security-focused file system policies (preventing root/anonymous access, enforcing read-only/encryption) and emphasize encryption-at-rest by default. While these are security features, there is no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/efs/latest/ug/creating-using-create-fs.md b/efs/latest/ug/creating-using-create-fs.md index 5dbbd4551..906c1ce2f 100644 --- a//efs/latest/ug/creating-using-create-fs.md +++ b//efs/latest/ug/creating-using-create-fs.md @@ -5 +5 @@ -Required IAM permissions for creating file systemsConfiguration options +Required IAM permissions for creating file systemsConfiguration options for file systems @@ -9 +9 @@ Required IAM permissions for creating file systemsConfiguration options -Following, you can learn how to create an Amazon EFS file system by using the AWS Management Console and the AWS CLI. +You can create a file system when you create a new EC2 launch instance, as explained in the [Getting started exercise](./getting-started.html). However, you can also create file systems by using the Amazon EFS console, the AWS Command Line Interface (AWS CLI), or the Amazon EFS API. @@ -11 +11 @@ Following, you can learn how to create an Amazon EFS file system by using the AW -###### Topics +When creating the file system using the Amazon EFS console, you have different options, depending on whether you want the file system to use the recommended settings or if you want to customize the settings. @@ -13 +13 @@ Following, you can learn how to create an Amazon EFS file system by using the AW - * Required IAM permissions for creating file systems + * You can use Quick create to quickly create a file system with the following recommended settings. @@ -15 +15 @@ Following, you can learn how to create an Amazon EFS file system by using the AW - * Configuration options for file systems + * Regional availability @@ -16,0 +17 @@ Following, you can learn how to create an Amazon EFS file system by using the AW + * Lifecycle policies to transition the file system to EFS Infrequent Access (IA) storage after 30 days, to EFS Archive storage after 90 days, and not to transition to EFS Standard storage @@ -17,0 +19 @@ Following, you can learn how to create an Amazon EFS file system by using the AW + * Encryption of data at rest enabled @@ -18,0 +21 @@ Following, you can learn how to create an Amazon EFS file system by using the AW + * Elastic throughput mode @@ -20,7 +23 @@ Following, you can learn how to create an Amazon EFS file system by using the AW -## Required IAM permissions for creating file systems - -To create EFS resources, such as a file system and access points, you must have AWS Identity and Access Management (IAM) permissions for the corresponding API operation and resource. - -Create IAM users and grant them permissions for Amazon EFS actions with user policies. You can also use roles to grant cross-account permissions. Amazon Elastic File System also uses an IAM service-linked role that includes permissions required to call other AWS services on your behalf. For more information about managing permissions for API operations, see [Identity and access management for Amazon EFS](./security-iam.html). - -## Configuration options for file systems + * General Purpose performance mode @@ -28,13 +25 @@ Create IAM users and grant them permissions for Amazon EFS actions with user pol -You can create a file system by using the Amazon EFS console or by using the AWS Command Line Interface (AWS CLI). You can also create file systems programmatically by using AWS SDKs or the Amazon EFS API directly. If you're using the Amazon EFS API or an AWS SDK, you can use the `CreateFileSystem` EFS API action to create file system policies. - -When creating an Amazon EFS file system by using the custom create flow in the console or the AWS CLI, you can choose settings for the following file system features and configuration options. - -### File system type - -The file system type determines the [availability and durability](./features.html#availability-durability) with which an Amazon EFS file system stores data within an AWS Region. You have the following choices for your file system type: - - * Choose **Regional** to create a file system that stores data and metadata redundantly across all Availability Zones within an AWS Region. You can also create mount targets in each Availability Zone in the AWS Region. Regional offers the highest levels of availability and durability. - - * Choose **One Zone** to create a file system that stores data and metadata redundantly within a single Availability Zone. File systems that use One Zone file system type can have only a single mount target. This mount target must be located in the same Availability Zone in which the file system is created. - -###### Note + * Mount targets configured in each Availability Zone in the AWS Region in which the file system is created @@ -42 +27 @@ The file system type determines the [availability and durability](./features.htm -One Zone file systems are available to only certain Availability Zones. For a table that lists the Availability Zones in which you can use One Zone file systems, see [Supported Availability Zones for One Zone file systems](./features.html#OneZoneAZs). + * You can use Customize to create a file system with the settings you choose. @@ -47 +32 @@ One Zone file systems are available to only certain Availability Zones. For a ta -### Automatic backups +For a table that lists the file system settings and the recommended values, see Configuration options for file systems. @@ -49,7 +34 @@ One Zone file systems are available to only certain Availability Zones. For a ta -Automatic backups are always enabled by default when you create a file system by using the console. When you use the CLI or API to create a file system, automatic backups are enabled by default only when you are creating file systems that are using One Zone file systems. For more information, see [Managing automatic backups of EFS file systems](./automatic-backups.html). - -### Lifecycle policies - -Lifecycle management uses lifecycle policies to automatically move files into and out of the lower-cost Infrequent Access (IA) storage class based on access patterns. When you create a file system by using the AWS Management Console, the file system's lifecycle policy is configured with the following default settings: - - * **Transition into IA** set to **30 days since last access**. +## Required IAM permissions for creating file systems @@ -57 +36 @@ Lifecycle management uses lifecycle policies to automatically move files into an - * **TransitionToArchive** set to **90 days since last access.** +To create EFS resources, such as a file system and access points, you must have AWS Identity and Access Management (IAM) permissions for the corresponding API operation and resource. @@ -59 +38 @@ Lifecycle management uses lifecycle policies to automatically move files into an - * **Transition into Standard** set to **None**. +Create IAM users and grant them permissions for Amazon EFS actions with user policies. You can also use roles to grant cross-account permissions. Amazon Elastic File System also uses an IAM service-linked role that includes permissions required to call other AWS services on your behalf. For more information about managing permissions for API operations, see [Identity and access management for Amazon EFS](./security-iam.html). @@ -60,0 +40 @@ Lifecycle management uses lifecycle policies to automatically move files into an +## Configuration options for file systems @@ -61,0 +42 @@ Lifecycle management uses lifecycle policies to automatically move files into an +EFS file systems are configured with the settings listed in the following table. @@ -62,0 +44 @@ Lifecycle management uses lifecycle policies to automatically move files into an + * If you use Quick create to create the file system, the file system is created with the indicated recommended value for the setting. @@ -64 +46 @@ Lifecycle management uses lifecycle policies to automatically move files into an -When you create a file system by using the AWS CLI, Amazon EFS API, or AWS SDKs, you cannot set a lifecycle policy at the same time. You must wait until the file system is created, and then use the [PutLifecycleConfiguration](./API_PutLifecycleConfiguration.html) API operation to update the lifecycle policy. For more information, see [EFS storage classes](./features.html#storage-classes) and [Managing storage lifecycle](./lifecycle-management-efs.html). + * If use Customize to create a custom file system, you can change the recommended value for the setting. @@ -66 +47,0 @@ When you create a file system by using the AWS CLI, Amazon EFS API, or AWS SDKs, -### Encryption @@ -68 +48,0 @@ When you create a file system by using the AWS CLI, Amazon EFS API, or AWS SDKs, -You can enable encryption if data at rest when creating a file system. If you enable encryption for your file system, all data and metadata stored on it are encrypted. Once you create an EFS file system, you cannot change its encryption setting. This means that you cannot modify an unencrypted file system to make it encrypted. Instead, you need to create a new, encrypted file system. For more information about Amazon EFS encryption, see [Encrypting data in Amazon EFS](./encryption.html). @@ -70 +49,0 @@ You can enable encryption if data at rest when creating a file system. If you en -To create the file system mount targets in your VPC, you must specify VPC subnets. The console pre-populates the list of VPCs in your account that are in the selected AWS Region. First, you select your VPC, and then the console lists the Availability Zones in the VPC. For each Availability Zone, you can select a subnet from the list, or use the default subnet if it exists. After you select a subnet, you can either specify an available IP address in the subnet or let Amazon EFS choose an address automatically. @@ -72 +51 @@ To create the file system mount targets in your VPC, you must specify VPC subnet -### Throughput modes +After you create the file system, you can customize the file system's settings with the exception of file system type, encryption, and performance mode. @@ -74 +53,3 @@ To create the file system mount targets in your VPC, you must specify VPC subnet -There are three throughput modes to choose from: +EFS file system settings Setting | Description +---|--- +**File system type** | _Recommended: Regional_ The file system type determines the [availability and durability](./features.html#availability-durability) with which an EFS file system stores data within an AWS Region. @@ -76 +57,2 @@ There are three throughput modes to choose from: - * **Elastic** (Recommended) – Provides throughput that scales up and down automatically in real time, to meet your workload’s performance needs. + * **Regional** file systems store data and metadata redundantly across all Availability Zones within an AWS Region. You can also create mount targets in each Availability Zone in the AWS Region. Regional offers the highest levels of availability and durability. + * **One Zone** file systems store data and metadata redundantly within a single Availability Zone. One Zone file systems can have only a single mount target. This mount target must be located in the same Availability Zone in which the file system is created. @@ -80 +62 @@ There are three throughput modes to choose from: -Elastic throughput is available only for file systems that have the General Purpose performance mode. +One Zone file systems are available to only certain Availability Zones. @@ -82 +64,2 @@ Elastic throughput is available only for file systems that have the General Purp - * **Provisioned** – Provides the level of throughput you specify, independent of the file system's size. +For more information about file system types, see [Availability and durability of EFS file systems](./features.html#availability-durability). +**Lifecycle management** | _Recommended: Transition into IA storage after 30 days and into Archive storage after 90 days. Do not transition into Standard storage._ Lifecycle management uses lifecycle policies to automatically move files in to and out of the lower-cost Infrequent Access (IA) storage class based on access patterns. When you create a file system by using the AWS Management Console, the file system's lifecycle policy is configured with the following default settings: @@ -84 +67,3 @@ Elastic throughput is available only for file systems that have the General Purp - * **Bursting** – Provides throughput that scales with the amount of data in Standard storage. + * **Transition into IA** set to **30 days since last access**. + * **Transition into Archive** set to **90 days since last access.** + * **Transition into Standard** set to **None**. @@ -85,0 +71,3 @@ Elastic throughput is available only for file systems that have the General Purp +When you create a file system by using the AWS CLI, Amazon EFS API, or AWS SDKs, you cannot set a lifecycle policy at the same time. You must wait until the file system is created, and then use the [PutLifecycleConfiguration](./API_PutLifecycleConfiguration.html) API operation to update the lifecycle policy. For more information about lifecycle management, see [Managing storage lifecycle](./lifecycle-management-efs.html). +**Encryption at rest** | _Recommended: Enabled_ Amazon EFS uses your AWS Key Management Service (AWS KMS) EFS service key (`aws/elasticfilesystem`) to encrypt data at rest by default. With encryption, all data and metadata stored on it are encrypted. Once you create an EFS file system, you cannot change its encryption setting. This means that you cannot modify an unencrypted file system to make it encrypted. Instead, you need to create a new, encrypted file system. For more information about Amazon EFS encryption, see [Encrypting data in Amazon EFS](./encryption.html). +**Throughput mode** | _Recommended: Elastic_ You can choose from the following throughput modes: @@ -86,0 +75,3 @@ Elastic throughput is available only for file systems that have the General Purp + * **Elastic** – Provides throughput that scales up and down automatically in real time, to meet your workload’s performance needs. + * **Provisioned** – Specify the throughput amount that you want, independent of the file system's size. + * **Bursting** – Provides throughput that scales with the amount of data in Standard storage. @@ -89 +79,0 @@ Elastic throughput is available only for file systems that have the General Purp -For more information, see [Throughput modes](./performance.html#throughput-modes). @@ -93,12 +83,2 @@ For more information, see [Throughput modes](./performance.html#throughput-modes -Additional charges are associated with using Elastic and Provisioned throughput. For more information, see [Amazon EFS pricing](https://aws.amazon.com/efs/pricing/). - -### Performance modes - -When creating a file system, you also choose a performance mode. There are two modes to choose from— _General Purpose_ and _Max I/O_. - - * **General Purpose mode** has the lowest per-operation latency and is recommended for all file systems. - - * **Max I/O** is a previous generation performance type that is designed for highly parallelized workloads that can tolerate higher latencies than the General Purpose mode. Max I/O mode is not supported for One Zone file systems or file systems that use Elastic throughput. - - - +Additional charges are associated with using Elastic and Provisioned throughput. For more information, see [Amazon EFS pricing](https://aws.amazon.com/efs/pricing/). For more information about throughput modes, see [Throughput modes](./performance.html#throughput-modes). +**Performance mode** | _Recommended: General Purpose_ The **General Purpose** performance mode has the lowest per-operation latency and is recommended for all file systems. **Max I/O** is a previous generation performance type that is designed for highly parallelized workloads that can tolerate higher latencies than the General Purpose mode. Max I/O mode is not supported for One Zone file systems or file systems that use Elastic throughput. @@ -108 +88,7 @@ When creating a file system, you also choose a performance mode. There are two m -Due to the higher per-operation latencies with Max I/O, we recommend using General Purpose performance mode for all file systems. +Due to the higher per-operation latencies with Max I/O, we recommend using General Purpose performance mode for all file systems. For more information, see [Performance modes](./performance.html#performancemodes). +**Network access** | _Recommended: Mount target created in each Availablity Zone in which the file system is available_ The mount target settings are as follows: + + * **VPC** – You can create mount targets for the file system in one VPC at a time. By default, the EC2 instance's default subnet is selected. Change the VPC if you need to access the file system from a different VPC. If you want to change the VPC after creating the after the file system, you need to first delete the mount targets from the current VPC. For more information, see [Changing the mount target VPC](./manage-fs-access-change-vpc.html). + * **Availability Zone** and **Subnet ID** – You can change the Availability Zone or subnet for the mount target. + * **IP address** \- By default, Amazon EFS creates the mount target at an available address on the specified subnet. Alternately, you can specify the IP address for the mount target. You can't change the IP address of a mount target after it's created. You need to delete the mount target and create a new one with the new address. + * **Security group** – The security group assigned to the VPC target is used by default. You can add or remove security groups. For more informationi about security groups, see [Changing mount target security groups](./manage-fs-access-update-mount-target-config-sg.html). @@ -110 +96 @@ Due to the higher per-operation latencies with Max I/O, we recommend using Gener -For more information, see [Performance modes](./performance.html#performancemodes). +When you create a file system by using the AWS CLI, Amazon EFS API, or AWS SDKs, you cannot create a mount target at the same time. You must wait until the file system is created, and then use the [CreateMountTarget](./API_CreateMountTarget.html) API operation to create the mount targets. For more information about mount targets, see [Managing mount targets](./accessing-fs.html). @@ -112 +98 @@ For more information, see [Performance modes](./performance.html#performancemode -In this step, use the Amazon EFS console to create an Amazon EFS file system that has the recommended settings. If you want to create a file system with a customized configuration, see Custom using the console. +Use the Amazon EFS console to create an Amazon EFS file system that has the recommended settings. If you want to create a file system with a customized configuration, see Custom create using the console. @@ -126,9 +112 @@ In this step, use the Amazon EFS console to create an Amazon EFS file system tha - * Automatic backups enabled. For more information, see [Backing up EFS file systems](./awsbackup.html). - - * Mount targets configured with the following settings: - - * Created in each Availability Zone in the AWS Region in which the file system is created. - - * Located in the default subnets of the VPC you selected. - - * Using the VPC's default security group – You can manage security groups after the file system is the created. + * Regional availability. @@ -136 +114 @@ In this step, use the Amazon EFS console to create an Amazon EFS file system tha -For more information, see [Managing mount targets](./accessing-fs.html). + * General Purpose performance mode. @@ -138 +116 @@ For more information, see [Managing mount targets](./accessing-fs.html). - * Regional file system type – For more information, see [EFS file system types](./features.html#file-system-type). + * Elastic throughput mode. @@ -140 +118 @@ For more information, see [Managing mount targets](./accessing-fs.html). - * General Purpose performance – For more information, see [Performance modes](./performance.html#performancemodes). + * Encryption of data at rest enabled. @@ -142 +120 @@ For more information, see [Managing mount targets](./accessing-fs.html). - * Elastic throughput – For more information, see [Throughput modes](./performance.html#throughput-modes). + * Lifecycle management policies to transition into IA and Archive storage. @@ -144,13 +122 @@ For more information, see [Managing mount targets](./accessing-fs.html). - * Encryption of data at rest enabled using your default key for Amazon EFS (`aws/elasticfilesystem`) – For more information, see [Encrypting data at rest](./encryption-at-rest.html). - - * Lifecycle management – Amazon EFS creates the file system with the following lifecycle policies: - - * **Transition into IA** set to **30 days since last access**. - - * **TransitionToArchive** set to **90 days since last access.** - - * **Transition into Standard** set to **None**. - -For more information, see [Managing storage lifecycle](./lifecycle-management-efs.html). - -After you create the file system, you can customize the file system's settings with the exception of availability and durability, encryption, and performance mode. + * Mount targets configured in each Availability Zone in the AWS Region in which the file system is created. @@ -186 +152 @@ Creating an EFS file system with custom settings by using the console is a four- - 3. Choose **Customize** to create a customized file system instead of creating a file system by using the service-recommended settings. The **File system settings** page opens. + 3. Choose **Customize** to create a customized file system instead of creating a file system by using the recommended settings. The **File system settings** page opens. @@ -192,5 +158 @@ Creating an EFS file system with custom settings by using the console is a four- - 2. For **File system type** , choose an availability option: - - * Choose **Regional** to create a file system that stores file system data and metadata redundantly across all Availability Zones within an AWS Region. **Regional** offers the highest levels of availability and durability. - - * Choose **One Zone** to create a file system that stores file system data and metadata redundantly within a single Availability Zone. If you choose **One Zone** , choose the **Availability Zone** that you want the file system created in, or keep the default value. For more information, see [EFS storage classes](./features.html#storage-classes). + 2. For **File system type** , **Regional** is selected by default. Choose **One Zone** if you want to create a file system that stores file system data and metadata redundantly within a single Availability Zone. If you choose **One Zone** , choose the **Availability Zone** that you want the file system created in, or keep the default value. @@ -198,3 +160 @@ Creating an EFS file system with custom settings by using the console is a four- - 3. **Automatic backups** are turned on by default. You can turn off automatic backups by clearing the check box. For more information, see [Backing up EFS file systems](./awsbackup.html). -