Amazon EFS

What it is

Amazon Elastic File System (Amazon EFS) is a serverless, elastic shared file system for Linux. Clients mount it over NFS (Network File System)A protocol for sharing files over a network, used mostly by Linux and Unix systems. Amazon EFS, Amazon FSx for OpenZFS, and Amazon FSx for NetApp ONTAP provide NFS file systems.Glossary entry (NFSv4.0 and NFSv4.1) and see an ordinary POSIX file system, with directories, permissions, and file locking. It grows and shrinks automatically as you add and delete files, to petabyte scale, so you never provision capacity, and you pay only for what you store.

Thousands of clients can use one file system at the same time: EC2 instances, containers on ECS, EKS, and Fargate, and Lambda functions, across AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry, plus On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry servers over Direct Connect or Site-to-Site VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry. Windows instances aren't supported; for Windows file shares, use Amazon FSx for Windows File Server.

Choose EFS for content management and web serving, shared home directories, development tools, container and serverless storage that must outlive a task, and lift-and-shift Linux applications that expect a shared file system. For one instance's disk, use Amazon EBS; for objects, use Amazon S3.

File system types

Type	Stores data	Choose for
Regional (recommended)	Redundantly across multiple Availability Zones	Production: the data stays available even if an Availability Zone is unavailable
One Zone	In one Availability Zone	Lower cost for data you can re-create, or dev and test; data can be lost if the zone is damaged

A file system lives in one VPC. You create a mount target (an ENI (Elastic network interface)A virtual network card in a VPC subnet, with private IP addresses, security groups, and a MAC address. EC2 instances, Lambda functions connected to a VPC, and interface endpoints all connect through network interfaces.Glossary entry with an IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry address) in a SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry, one per Availability Zone. Clients in that zone mount through it. One Zone file systems have a single mount target in their zone.

Amazon EFS across Availability Zones. In a VPC, Availability Zone A and Availability Zone B each have a mount target. An EC2 instance in each zone mounts the file system over NFS through the mount target in its own zone, and both mount targets reach the same Regional EFS file system.

Storage classes and lifecycle management

Class	For data accessed	Notes
EFS Standard	Frequently	SSD (Solid state drive)Storage on flash memory with no moving parts, fast at small random reads and writes (high IOPS). Amazon EBS gp3, gp2, io2, and io1 volumes are SSD-backed.Glossary entry storage, the lowest LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry
EFS Infrequent Access (IA)	A few times a quarter	Lower storage price, plus a charge for reads and tiering
EFS Archive	A few times a year or less	Lowest storage price; 90-day minimum storage charge

Lifecycle management moves files by when they were last accessed. By default, files move to IA after 30 days and to Archive after 90 days without access.
By default, files stay in IA or Archive when read. Set Transition into Standard: On first access to move them back for latency-sensitive workloads.
IA and Archive have a 128 KiB minimum billable file size, so tiny files cost more there than their size suggests.

Performance and throughput

Performance mode: General Purpose (the default and recommended) has the lowest latency. Max I/O has higher per-operation latency and is a legacy choice; One Zone file systems always use General Purpose.
Throughput mode:
- Elastic (the default and recommended) scales throughput automatically with your workload, up to tens of GiB per second of reads for Regional file systems, and you pay for the data you read and write.
- Provisioned sets a fixed throughput regardless of size, for steady, predictable workloads. After you switch to it or increase it, you must wait 24 hours before decreasing it or changing mode.
- Bursting scales throughput with the amount stored, using burst credits; it suits small file systems with occasional peaks.
Latency on EFS Standard is as low as about 1 ms for reads and 2.7 ms for writes (Regional). One client reaches up to 1,500 MiB/s with Elastic throughput and a current EFS client (500 MiB/s otherwise), so spread heavy work across many clients.

Security, resilience, performance, and cost

Security

Network: each mount target has Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry. Allow NFS on TCP (Transmission Control Protocol)The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.Glossary entry port 2049 from the clients' security groups, and clients must be allowed to reach the mount target on port 2049.
IAM authorization for NFS clients: a file system policy (resource-based) plus identity policies decide which PrincipalA person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.Glossary entry can mount, read, write, or act as root. You can also require Encryption in transitEncrypting data while it moves across a network, usually with TLS, so that it cannot be read or changed on the way.Glossary entry in the policy.
Access points are application-specific entry points that enforce a POSIX user and group and a root directory, so each application or container sees only its own directory with the right identity.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry uses AWS KMS. It is on by default when you create a file system in the console, but must be requested explicitly with the CLI, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, or SDK (Software development kit)A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.Glossary entry, and can't be changed after creation. To encrypt an unencrypted file system, replicate or copy its data to a new encrypted one.
Encryption in transit uses TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry, enabled as a mount option through the EFS mount helper (amazon-efs-utils).

Resilience

Regional file systems survive the loss of an Availability Zone; mount from instances in several zones, each through its own zone's mount target.
Replication keeps a read-only copy in a AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry you choose (or another account), with a 15-minute RPO (Recovery point objective)The most data, measured in time, that a workload can afford to lose in a disaster. With an RPO of one hour, data must be restorable to no more than an hour before the failure.Glossary entry for most file systems. To FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry, delete the replication configuration, and the replica becomes writable; you can later fail back.
AWS Backup handles backups. File systems created in the console are backed up automatically by default; with the CLI or API, automatic backups are on by default only for One Zone file systems.

Cost

Pay per GB-month stored in each class (no provisioning), plus reads and writes with Elastic throughput (or the provisioned throughput), and reads and tiering for IA and Archive.
One Zone costs less than Regional. Lifecycle management to IA and Archive cuts storage costs for cold files.

Monitoring

CloudWatch metrics include throughput, I/O, storage by class, client connections, and TimeSinceLastSync for replication.
CloudTrail records EFS API calls and, with IAM authorization, client connections and authorization decisions.

EFS, EBS, FSx, or S3?

If the requirement is	Choose
Shared POSIX file system for many Linux clients across AZs	Amazon EFS
Persistent storage shared by Fargate tasks or Lambda functions	Amazon EFS
Low-latency disk for one instance	Amazon EBS
Windows SMB (Server Message Block)The file-sharing protocol used by Windows. Amazon FSx for Windows File Server and Amazon FSx for NetApp ONTAP provide SMB shares, and Amazon S3 File Gateway can present S3 buckets as SMB shares.Glossary entry shares with Active Directory	FSx for Windows File Server
HPC (High performance computing)Using many powerful computers together on large problems, such as simulations, genomics, or weather forecasting, often with fast networking between them. On AWS it uses EC2 instances with Elastic Fabric Adapter, AWS Batch, and AWS ParallelCluster.Glossary entry with very high throughput, linked to S3	FSx for Lustre
Objects at any scale over an API	Amazon S3

Reverse mindmap: when the question points here

Is it Amazon EFS?

Yes, when the question says
- Many Linux EC2 instances share files across AZs leads to EFS Regional
- Shared storage for Fargate or Lambda leads to EFS
- NFS file system that grows automatically leads to EFS
- On-premises Linux servers mount cloud files leads to EFS over Direct Connect or VPN
Configure it
- Lower cost for re-creatable data leads to One Zone
- Cold files cost less automatically leads to Lifecycle to IA and Archive
- Spiky, unpredictable throughput leads to Elastic throughput
- Steady high throughput regardless of size leads to Provisioned throughput
Secure and protect it
- Each app sees only its directory as one user leads to Access points
- Only some IAM roles can mount leads to File system policy
- Encrypt data at rest leads to Choose encryption at creation
- Encrypt NFS traffic leads to TLS with the EFS mount helper
- Copy in another Region, 15-minute RPO leads to EFS replication
No, when the question says
- Windows clients over SMB leads to FSx for Windows File Server
- Block disk for one instance leads to Amazon EBS

Key takeaways

EFS is serverless NFS storage for Linux that grows and shrinks automatically; Windows isn't supported.
Regional file systems span several Availability Zones, with one mount target per zone; One Zone is cheaper but uses one zone.
Lifecycle management moves cold files to IA (30 days) and Archive (90 days) by default.
Use General Purpose performance mode and Elastic throughput unless you have a reason not to.
Secure it with security groups on port 2049, IAM file system policies, access points, KMS encryption chosen at creation, and TLS in transit; replicate with a 15-minute RPO and back up with AWS Backup.