CODEWITHSUNDEEP
amazon-web-servicesamazon-ecsamazon-efs
Markus Müller
Markus Müller

Reputation: 2631

Accessing EFS file system from Fargate ECS task - Not working without any kind of error message

I tried to connect an EFS file system to an ECS Fargate Task, based on the examples in the documentation. I cannot write to the volume (sadly I cannot change the container in a way to report if it can write from there)

The task is provisioned without any error, but the starting container cannot write into the mounted volume.

In contrast to some other questions here, I do NOT get any error message from AWS. Just the container reporting an AccessDeniedException.

I am running out of ideas how to troubleshoot this.

Whatever I change in the configuration, the behaviour stays the same. When I add erros to the filesystem ID or access point ID those are catched however, so the console thinks the configuration is fine.

I can see client connects for the file system in CloudWatch, however I do not see if those are successful or not. Does that mean networking is fine, but access permissions are wrong?

Task config:

            "mountPoints": [
                {
                    "sourceVolume": "controlserver-files",
                    "containerPath": "/application/files",
                    "readOnly": false
                }
            ],

    "volumes": [
        {
            "name": "controlserver-files",
            "efsVolumeConfiguration": {
                "fileSystemId": "fs-99999999999",
                "rootDirectory": "/",
                "transitEncryption": "ENABLED"
            }
        }
    ],

File system policy:

        {
            "Sid": "efs-statement-08270b77-b8c4-4788-b12a-7226fbcc0e21",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:ClientMount"
            ],
            "Resource": "arn:aws:elasticfilesystem:eu-central-1:977555550711:file-system/fs-02bab7777777774"
        }

Upvotes: 0

Views: 3342

Answers (1)

Anda
Anda

Reputation: 26

Did you have a look on permissions on the EFS volume itself? There is this useful blog post: https://aws.amazon.com/blogs/containers/developers-guide-to-using-amazon-efs-with-amazon-ecs-and-aws-fargate-part-2/

I would first start by mounting EFS to ie your local machine or an EC2 instance and check the permissions on the root folder. For testing, you may set the permissions to 777 so that anyone, any UID, can read and write there.

$ sudo chmod 777 /EFSroot

If this works, I would go and be less permissive. You may check this doc on permissions for NFS: https://docs.aws.amazon.com/efs/latest/ug/accessing-fs-nfs-permissions.html

Feel free to share the results.

Upvotes: 1

Related Questions