Creating the EFS

Procedure

  1. Create a new EFS (Elastic File System) instance for the cluster.
  2. Get the VPC ID and the CIDR block of the VPC where the cluster was created: 
    VPC_ID=$(aws eks describe-cluster --name $CLUSTER_NAME --query "cluster.resourcesVpcConfig.vpcId" --region $AWS_REGION --output text)
CIDR_BLOCK=$(aws ec2 describe-vpcs --vpc-ids $VPC_ID --query "Vpcs[].CidrBlock" --region $AWS_REGION --output text)
  3. Choose a creation token and a name for the EFS, and save them in variables: 
    CREATION_TOKEN=link-efs-token
EFS_FS_NAME=link-efs
    The EFS name will be stored as the value of the Name tag.
  4. Create the EFS instance and capture its File System ID: 
    EFS_FS_ID=$(aws efs create-file-system \
  --creation-token $CREATION_TOKEN \
  --encrypted \
  --performance-mode generalPurpose \
  --throughput-mode bursting \
  --tags Key=Name,Value=$EFS_FS_NAME \
  --region $AWS_REGION \
  --output text \
  --query "FileSystemId")
  5. Create a security group (SG) for the EFS instance and configure it to authorize ingress traffic to the EFS on the standard NFS port 2049.
  6. Capture the security group description and name in shell variables: 
    EFS_SG_DESCRIPTION="Security Group for EFS"
EFS_SG_NAME=link-link-efs-sg
  7. Create the security group: 
    EFS_SG_ID=$(aws ec2 create-security-group \
  --description "$EFS_SG_DESCRIPTION" \
  --group-name $EFS_SG_NAME \
  --vpc-id $VPC_ID \
  --region $AWS_REGION \
  --query 'GroupId' --output text)
  8. Authorize inbound traffic on port 2049: 
    aws ec2 authorize-security-group-ingress \
  --group-id $EFS_SG_ID \
  --protocol tcp \
  --port 2049 \
  --cidr $CIDR_BLOCK
  9. Create an EFS mount target in each subnet in the VPC: 
    for subnet in $(aws eks describe-fargate-profile \
  --output text --cluster-name $CLUSTER_NAME \
  --fargate-profile-name fp-default \
  --region $AWS_REGION \
  --query "fargateProfile.subnets"); \
do
  aws efs create-mount-target \
    --file-system-id $EFS_FS_ID \
    --subnet-id $subnet \
    --security-group $EFS_SG_ID \
    --region $AWS_REGION
done