CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2amazon-efs
Vic_RTP
Vic_RTP

Reputation: 115

What is wrong with this AWS EFS policy?

I'm pretty new at working with AWS and I'm just experimenting and trying to learn. So I have an EC2 instance with an IAM role attached. I also have an EFS filesystem with the below policy in place. My intent was to restrict mounting the access point to EC2 instances with the IAM role attached.

But when I try to mount from the EC2 instance I get access denied.

mount.nfs4: access denied by server while mounting 127.0.0.1:

If I change the principal to "AWS" : "*" I can mount the access point. According to the docs I can specify the IAM role used by the EC2 instance as the principal but it doesn't seem to work.

I suspect my problem is somehow with the role I have attached to the EC2 instance. The role has EFS client actions but when I look at the role in the IAM console and check access adviser, it says the role is never accessed. So I may be doing something fundamentally wrong.

{
    "Version": "2020-08-08",
    "Id": "access-point-www",
    "Statement": [
        {
            "Sid": "access-point-webstorage",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::12345678:role/wwwservers"
            },
            "Action": [
                "elasticfilesystem:ClientMount",
                "elasticfilesystem:ClientWrite"
            ],
            "Resource": "arn:aws:elasticfilesystem:us-east-1:12345678:file-system/fs-987654da",
            "Condition": {
                "StringEquals": {
                    "elasticfilesystem:AccessPointArn": "arn:aws:elasticfilesystem:us-east-1:12345678:access-point/fsap-01ffffbfb38217bcd"
                }
            }
        }
    ]
}

Upvotes: 2

Views: 4491

Answers (2)

theSpuka
theSpuka

Reputation: 149

Simply pass this as part of the mount command: -o tls,iam

Upvotes: 0

hashier
hashier

Reputation: 4750

Did you enable IAM mounting? Otherwise AWS tries to mount the EFS volume as a anonymous principle.

For EC2, like your case, you might just provide -o iam as option to your call to mount.
See: https://docs.amazonaws.cn/en_us/efs/latest/ug/efs-mount-helper.html#mounting-IAM-option

For ECS/task definitions this can be done this way:

Like this here: aws_ecs_task_definition.volume.efs_volume_configuration.authorization_config?

resource "aws_ecs_task_definition" "service" {
  family = "something"
  container_definitions = file("something.json")

  volume {
    name = "service-storage"
    
    efs_volume_configuration {
      file_system_id     = aws_efs_file_system.efs[0].id
      root_directory     = "/"
      transit_encryption = "ENABLED"
      authorization_config {
        iam = "ENABLED"
      }
    }
  }
}

iam - (Optional) Whether or not to use the Amazon ECS task IAM role defined in a task definition when mounting the Amazon EFS file system. If enabled, transit encryption must be enabled in the EFSVolumeConfiguration. Valid values: ENABLED, DISABLED. If this parameter is omitted, the default value of DISABLED is used.

This will help you if you have errors in your CloudTrail that an anonymous principal tries to mount your EFS. Errors would look something like this then:

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "AWSAccount",
        "principalId": "",
        "accountId": "ANONYMOUS_PRINCIPAL"
    },
    "eventSource": "elasticfilesystem.amazonaws.com",
    "eventName": "NewClientConnection",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "elasticfilesystem",
    "errorCode": "AccessDenied",
    "readOnly": true,
    "resources": [
        {
            "accountId": "XXXXXX",
            "type": "AWS::EFS::FileSystem",
            "ARN": "arn:aws:elasticfilesystem:eu-west-1:XXXXXX:file-system/YYYYYY"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "XXXXXX",
    "sharedEventID": "ZZZZZZZZ",
    "serviceEventDetails": {
        "permissions": {
            "ClientRootAccess": false,
            "ClientMount": false,
            "ClientWrite": false
        },
        "sourceIpAddress": "nnnnnnn"
    }
}

Note: "principalId": "", and "accountId": "ANONYMOUS_PRINCIPAL"

Upvotes: 3

Related Questions