Building Shared File Storage with Amazon EFS - Mounting from Lambda, ECS, and EC2 with Design Guidelines
Clarify the criteria for selecting performance modes and throughput modes, and learn how to optimize costs through lifecycle management with automatic tiering to the IA storage class.
EFS Features and When to Choose EFS Over EBS and S3
EFS is an NFS v4.1-compliant managed file system whose key advantage is that multiple compute resources can mount it simultaneously. EBS is block storage attached to a single EC2 instance (except for io2 Multi-Attach), and S3 is object storage that cannot be mounted as a POSIX file system. When multiple instances or containers need to access the same files, EFS is the only option. It is well suited for use cases such as shared media storage for CMS, sharing ML training data, and sharing CI/CD build caches. EFS requires no pre-provisioned capacity and scales automatically as files are added or removed. Data is redundantly stored across multiple AZs within a region, providing standard resilience against single-AZ failures. The One Zone storage class stores data in a single AZ only, offering lower pricing in exchange for accepting AZ failure risk.
Performance Modes and Throughput Modes
There are two performance modes: General Purpose and Max I/O. General Purpose offers lower latency and is suitable for most workloads. Max I/O is optimized for concurrent access from thousands of clients but introduces slightly higher latency. Performance mode cannot be changed after file system creation, so requirements must be evaluated during initial design. There are three throughput modes: Elastic, Provisioned, and Bursting. Elastic mode automatically scales throughput based on access patterns, providing up to 10 GiB/s of read throughput. Since it eliminates the need to manage burst credits, Elastic mode is recommended for new deployments. Provisioned mode is used when you need guaranteed throughput. Bursting mode provides baseline throughput proportional to file system size and handles short bursts using accumulated credits, but small file systems risk credit exhaustion.
Lifecycle Management and Cost Optimization
EFS lifecycle management automatically transitions files that have not been accessed for a specified period to the Infrequent Access (IA) storage class. IA storage pricing is approximately 8% of the Standard class, enabling up to 92% cost savings. Transition triggers can be set to 1, 7, 14, 30, 60, or 90 days. Accessing files in the IA class incurs a per-read access charge, but for infrequently accessed files, the storage cost savings outweigh this. Enabling Intelligent-Tiering also allows files that are accessed again to be automatically moved back to the Standard class. The Archive storage class offers even lower costs and is suitable for data accessed less frequently than IA (such as compliance retention data). As a cost optimization best practice, setting lifecycle management to transition to IA at 30 days with Intelligent-Tiering enabled is effective for many workloads. For a deeper understanding of EFS, specialized books (Amazon) are a helpful resource.
Mounting from Lambda, ECS, and EC2 - Design Patterns
For EC2 mounting, the amazon-efs-utils package is recommended, supporting TLS encrypted transport and IAM authentication. Security groups must allow NFS port (2049). For ECS (Fargate), specify the EFS file system ID and access point ID in the task definition volumes section. Access points enforce different root directories and POSIX users per container, which is effective for data isolation in multi-tenant environments. For Lambda, specify the VPC and file system mount path in the function configuration. When mounting EFS from Lambda, the function must run within a VPC, and the initial EFS connection establishment during cold start adds approximately several hundred milliseconds to first invocation - factor this into your design. Mounting the same EFS from multiple Lambda functions enables data sharing and cache persistence across functions.
Security and Backup
EFS can enforce encryption in transit (TLS) via file system policies, rejecting connections from unencrypted clients. Enabling IAM authentication validates IAM role permissions at mount time, allowing fine-grained control that permits access only to specific access points. POSIX permissions for file-level access control continue to function as usual. For backup, EFS integrates with AWS Backup, enabling scheduled automatic backups and point-in-time recovery. The replication feature creates a read-only EFS replica in another region, which can be leveraged for DR (disaster recovery). Failover to the replica requires manual action but can keep RTO to the order of minutes.
Summary
EFS is the only POSIX-compliant managed service on AWS for file storage that requires shared access from multiple compute resources. Combining Elastic throughput mode with lifecycle management optimizes both performance and cost. Mounting from Lambda and ECS enables shared file systems in serverless architectures, while access points for multi-tenant isolation and file system policies for encryption enforcement address security requirements.