Amazon EFS and Lambda / ECS Integration Patterns - Using Shared File Systems in Serverless
EFS is mounted on Lambda functions and ECS tasks to make use of a shared file system. This article introduces access point design and performance optimization.
Integrating Lambda with EFS
When you mount EFS on a Lambda function, you can access the file system through a path under /mnt. Lambda's /tmp directory can be configured up to 10 GB, and EFS is a file system that automatically grows and shrinks to match the workload. You can use it to process large machine learning models, datasets, and temporary files. In the configuration, you specify the Lambda function's VPC settings (subnets, security groups) and the EFS file system ID / access point ID. Because the Lambda function runs inside a VPC, you need to place it in the same subnet as the EFS mount target or in a routable subnet.
Designing Access Points
EFS access points are a feature that separates access to the file system by application. You set a root directory (for example, /app1, /app2) and a POSIX user (UID/GID) on each access point, and assign a different access point to each Lambda function. You can separate them so that function A accesses only what is under /app1 through /mnt/efs, and function B accesses only what is under /app2. When you enable IAM authorization, access control based on IAM roles becomes possible in the EFS file system policy, and you can restrict usage so that only specific Lambda functions can use specific access points.
ECS Task Integration and Performance
You define an EFS volume in the ECS task definition and specify the mount path with mountPoints in the container definition. Multiple containers in the same task can share the same EFS volume, and you can use this for a sidecar pattern setup in which a log collection container reads the log files of the application container. From a performance perspective, mounting EFS adds several hundred milliseconds of latency during a Lambda cold start. You keep the impact on latency down by avoiding Lambda cold starts with Provisioned Concurrency or by securing EFS throughput with Elastic throughput mode.
Pricing Considerations for EFS Integration
EFS pricing is determined by the storage class and the throughput mode. Standard storage costs about $0.30 per GB per month, and IA (Infrequent Access) costs about $0.016 (as of August 2026). To access EFS from Lambda, you connect the function to a VPC, and a new function cannot be invoked until the connection is ready, which can take a few minutes. For EFS throughput, Elastic mode is recommended, and it scales automatically according to access patterns. In cases where Lambda's /tmp (configurable up to 10 GB, with charges for the amount configured above 512 MB) is enough, you can use a setup without EFS.
Expanding Use Cases
When you combine EFS with serverless, you can run processing that handles files on Lambda and ECS. If you place a large machine learning model on EFS and share it for loading across multiple Lambda functions, you can run inference without being bound by the deployment package size limit. You can also use it to keep shared state in which multiple functions and tasks reference / update the same files. It also serves as a landing place when you migrate existing applications built on the assumption of a file system to containers without major rewrites. You can use it in workloads centered on file operations, such as processing that temporarily shares intermediate video and image files.
Choosing a Throughput Mode
EFS performance changes depending on which throughput mode you choose. The mode that automatically adjusts performance according to access volume (Elastic) suits workloads whose load fluctuations are hard to predict. If you want to secure a fixed level of performance, you choose the mode that allocates throughput in advance (Provisioned). With the traditional method, where performance is determined in proportion to the amount of stored data, performance can fall short when capacity is small and access is heavy, so this point needs attention. You choose a mode that balances latency and cost according to your access characteristics.
Availability and Backup
EFS Regional file systems store data redundantly across multiple Availability Zones, and One Zone file systems store it in a single zone. If you prepare a mount target in each zone, you can continue access from another zone even if one zone fails. You prepare for zone failures by combining this with a setup that distributes Lambda and ECS across multiple zones. To prepare for accidental deletion and data corruption, you work with a backup management service to take backups regularly and set up a system that lets you restore them as needed. For data you cannot afford to lose, there is a method of preparing for disasters by replicating it to another Region.
Security Design
To use a shared file system safely, you design multiple layers of protection. You protect data by enabling encryption of data at rest and also encrypting the communication path. You separate POSIX permissions and root directories for each access point to prevent access across application boundaries. In addition, by using IAM authorization and file system policies, you can control access so that only specific roles can use specific access points. With the mount target's security group, you allow connections only from permitted paths. By combining these, you build a setup that shares the file system with least privilege.
Summary
Integrating EFS with Lambda / ECS lets you make use of shared file systems even in serverless architectures. You can separate root directories and POSIX permissions per application with access points, and use them for data sharing between Lambda functions and for processing large files. With Intelligent-Tiering lifecycle management, you can move infrequently accessed files to IA and keep storage costs down.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon EFS official page
- AWS Lambda official page
- Amazon ECS official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.