EFS：Linux向け共有ファイルストレージ

Amazon EFS とは

EFS ストレージクラス

# Create an EFS file system in Standard storage class
aws efs create-file-system \
  --performance-mode generalPurpose \
  --throughput-mode elastic \
  --encrypted \
  --tags Key=Name,Value=SharedFileSystem

# One Zone (cheaper, single-AZ):
aws efs create-file-system \
  --performance-mode generalPurpose \
  --throughput-mode elastic \
  --encrypted \
  --availability-zone-name us-east-1a \
  --tags Key=Name,Value=SharedFileSystemOneZone

EFS のパフォーマンスモード

# Create EFS with Max I/O for highly parallel workloads
aws efs create-file-system \
  --performance-mode maxIO \
  --throughput-mode provisioned \
  --provisioned-throughput-in-mibps 1024 \
  --encrypted

# Note: Max I/O mode is NOT compatible with Elastic throughput mode
# It must use Provisioned or Bursting throughput

EFS のスループットモード

# Migrate an existing EFS from Bursting to Elastic throughput
aws efs update-file-system \
  --file-system-id fs-0abc1234def567890 \
  --throughput-mode elastic

# Check current throughput mode and performance mode
aws efs describe-file-systems \
  --file-system-id fs-0abc1234def567890 \
  --query 'FileSystems[].{ThroughputMode:ThroughputMode,PerfMode:PerformanceMode,SizeBytes:SizeInBytes.Value}'

マウントターゲットとセキュリティグループ

# Create a mount target in each AZ
aws efs create-mount-target \
  --file-system-id fs-0abc1234def567890 \
  --subnet-id subnet-aaa111 \
  --security-groups sg-efsnfs

aws efs create-mount-target \
  --file-system-id fs-0abc1234def567890 \
  --subnet-id subnet-bbb222 \
  --security-groups sg-efsnfs

# The EFS security group needs: Inbound TCP 2049 from instance SG

EC2 Linux への EFS のマウント

# Install the EFS mount helper
sudo yum install -y amazon-efs-utils

# Mount with TLS encryption in transit
sudo mkdir /mnt/efs
sudo mount -t efs -o tls fs-0abc1234def567890:/ /mnt/efs

# Persistent mount in /etc/fstab
# fs-0abc1234def567890:/ /mnt/efs efs defaults,_netdev,tls 0 0

# Verify mount
df -h /mnt/efs

EFS アクセスポイント

# Create an EFS Access Point for an application
aws efs create-access-point \
  --file-system-id fs-0abc1234def567890 \
  --posix-user Uid=1001,Gid=1001 \
  --root-directory Path=/data/app-a,CreationInfo={OwnerUid=1001,OwnerGid=1001,Permissions=755} \
  --tags Key=App,Value=app-a

# Mount using the access point
sudo mount -t efs \
  -o tls,accesspoint=fsap-0abc1234def567890 \
  fs-0abc1234def567890:/ /mnt/app-a

EFS Intelligent-Tiering とライフサイクル

# Enable lifecycle management (move to IA after 14 days)
aws efs put-lifecycle-configuration \
  --file-system-id fs-0abc1234def567890 \
  --lifecycle-policies '[
    {"TransitionToIA": "AFTER_14_DAYS"},
    {"TransitionToPrimaryStorageClass": "AFTER_1_ACCESS"}
  ]'

# Check current lifecycle configuration
aws efs describe-lifecycle-configuration \
  --file-system-id fs-0abc1234def567890

Lambda およびコンテナでの EFS

# Lambda function with EFS mount (CloudFormation excerpt)
# Resources:
#   MyFunction:
#     Type: AWS::Lambda::Function
#     Properties:
#       VpcConfig:
#         SubnetIds: [subnet-aaa]
#         SecurityGroupIds: [sg-lambda]
#       FileSystemConfigs:
#         - Arn: arn:aws:elasticfilesystem:us-east-1:111122223333:access-point/fsap-0abc
#           LocalMountPath: /mnt/models

# In function code:
# import os
# model_path = '/mnt/models/my-model.pkl'
# with open(model_path, 'rb') as f:
#     model = pickle.load(f)

EFS と EBS の違い：試験で重要なポイント

EFS の暗号化

# Create an EFS file system with encryption at rest
aws efs create-file-system \
  --encrypted \
  --kms-key-id arn:aws:kms:us-east-1:111122223333:key/KEY_ID

# Mount with TLS to encrypt in transit
sudo mount -t efs -o tls fs-0abc1234def567890:/ /mnt/efs

# Deny unencrypted mounts via EFS resource policy (condition)
# Condition: elasticfilesystem:AccessedViaMountTarget = true
# and aws:SecureTransport = true

クイックチェック

レッスンのまとめ