EFS network access is configured through Mount Targets and Security Groups. A Mount Target is an NFS endpoint created in each Availability Zone of your VPC that provides network access to the EFS file system. Each Mount Target gets a private IP address and must be associated with a Security Group that permits NFS traffic on port 2049.

Unlike EBS which attaches directly to an EC2 instance, EFS is accessed over the network via the NFS protocol. To make an EFS file system accessible within a VPC, you create Mount Targets — one per Availability Zone. Each Mount Target is an ENI (Elastic Network Interface) with a private IP address in a subnet you specify. EC2 instances connect to the EFS by reaching the Mount Target in their AZ using standard NFS protocol on port 2049.

Mount Targets — Key Concepts

1
One Mount Target per AZ — you should create one Mount Target in each AZ where your EC2 instances run, for lowest latency and highest availability
2
Each Mount Target lives in a specific subnet — choose the subnet where your EC2 instances reside
3
Each Mount Target gets a private IP address from the subnet's CIDR range
4
Each Mount Target is associated with one or more Security Groups
5
For Multi-AZ EFS (Standard storage class): create a Mount Target in each AZ — if one AZ fails, instances in other AZs still have access through their own Mount Targets
6
For One Zone EFS: only one Mount Target exists in the single AZ
7
DNS name — EFS provides a DNS name that automatically resolves to the Mount Target in the same AZ as the connecting instance (e.g., fs-0abc.efs.us-east-1.amazonaws.com)

Security Group Configuration for EFS

1
Mount Target Security Group — must have an inbound rule: Type=NFS, Protocol=TCP, Port=2049, Source=EC2 Security Group
2
EC2 Instance Security Group — must have an outbound rule: Type=NFS, Protocol=TCP, Port=2049, Destination=Mount Target Security Group
3
Best practice: create a dedicated EFS Security Group (e.g., 'efs-sg') and attach it to all Mount Targets
4
Reference the EC2 security group as the source in the EFS security group's inbound rule — do not use CIDR ranges, as they are less precise
5
For on-premises access via Direct Connect or VPN: the on-premises NFS client must be able to reach the Mount Target's IP on port 2049

VPC DNS Settings Required for EFS

1
The VPC must have DNS Resolution enabled (enableDnsSupport = true)
2
The VPC must have DNS Hostnames enabled (enableDnsHostnames = true)
3
These settings allow EC2 instances to resolve the EFS DNS name to the correct Mount Target IP in their AZ
4
Without DNS settings enabled, you would need to hard-code Mount Target IP addresses in mount commands, which is error-prone

Creating Mount Targets and Configuring Security Groups