Setting up EFS (Shared Storage)

Amazon Elastic File System (EFS) provides a scalable, fully managed shared file storage solution that can be mounted across multiple containers in an Amazon EKS cluster. This guide walks you through the complete process of setting up EFS and integrating it with your EKS cluster using the EFS CSI driver for dynamic provisioning.
Prerequisites

The EKS cluster and OIDC provider are fully configured and active.TCP port 2049 (NFS) is open between your EKS nodes and the EFS mount targets in the default security group — refer to Configuring virtual network.AWS CloudShell is accessible from your AWS Console.Step 1: Create the EFS File SystemIn the AWS Console, navigate to Elastic File System → File systems and click Create file system.Click Customize instead of the quick create option — this gives you control over the configuration.Enter a name for your file system.Set File system type to Regional. This replicates your data across multiple Availability Zones for higher availability.Enable or disable Automatic backups based on your requirements. Note that enabling backups will incur additional cost.Under Encryption, enable Encryption of data at rest. Leave all other settings as default and click Next.Under Network, select the VPC created in Configuring virtual network.Select all private subnets as mount targets — these are the subnets where your EKS nodes will mount the file system.Leave all other network settings as default, or customize performance and throughput settings as needed, and click Next.Review the configuration and click Create.VerificationOnce created, your EFS file system should appear in the file systems list with status Available.
Step 2: Assign required privileges to the EFS CSI Driver The EFS CSI Driver is the component that allows EKS pods to mount EFS as persistent storage. It requires an IAM role with the necessary permissions to interact with EFS.
​Open AWS CloudShell from the top bar of the AWS Console.If you have not already associated the OIDC provider with your EKS cluster, run the following command. Otherwise, skip to the next step.
%%CH%PRE0%%
Create the IAM role for the EFS CSI Driver by running:
%%CH%PRE1%%
Update your kubectl context to point to your EKS cluster:
%%CH%PRE2%%
Annotate the Kubernetes service account with the IAM role ARN created above. Replace <your-account> with your AWS account ID and <service-account-name> with the name used while creating the IAM role for the EFS CSI Driver (in step 3):
%%CH%PRE3%%
Verify the annotation was applied successfully:
%%CH%PRE4%%
If the annotation is present, your EKS service account is now linked to the IAM role and the EFS CSI Driver is authorized to mount EFS volumes.Step 3: Create an EFS Access PointAn EFS Access Point is a managed entry point into your EFS file system. It allows you to define application-specific access rules — including the directory, ownership (UID/GID), and permissions — for each application or pod that mounts the file system.Using the AWS ConsoleIn the AWS Console, navigate to Elastic File System → Access points.Click Create access point.Select your EFS file system.Under Root directory, set the path to /eks.Under POSIX user, set:User ID (UID): 1000Group ID (GID): 1000Under Root directory creation permissions, set:Owner user ID: 1000Owner group ID: 1000Permissions: 750Click Create access point.Using the AWS CLI (Alternative)If you prefer to use the CLI, run the following command. Replace fs-xxxxxxxxxxxx with your EFS file system ID:
%%CH%PRE5%%​VerificationOnce created, the access point should appear in the Access points list with status Available. Note the Access Point ID — you will need it in the next step.Step 4: Create a Storage ClassA Storage Class in Kubernetes defines how storage is dynamically provisioned for Persistent Volumes (PVs). You will create a Storage Class that uses the EFS CSI Driver to provision storage from your EFS file system.Using Lens IDEAdd your EKS cluster to Lens IDE by running the following command in AWS CloudShell or your terminal:
%%CH%PRE6%%
Open Lens IDE and expand your cluster in the left panel.Click the + icon at the bottom left and select Create resource.Paste the following YAML, replacing fs-xxxxxxxxxxxx with your actual EFS file system ID:
%%CH%PRE7%%
Click Save. This creates a new Storage Class named efs-sc in your cluster.Using kubectl (Alternative)If you prefer to use kubectl, save the above YAML to a file (for example, efs-storageclass.yaml) and run:
%%CH%PRE8%%VerificationVerify that the Storage Class was created successfully by running:
 %%CH%PRE9%%You should see efs-sc listed with provisioner efs.csi.aws.com. 
Next stepsAfter EFS setup, provision and configure the database:Provision the database — refer to Provisioning the database server for cloud deployment.Create the required schemas — refer to Setting up the database for cloud deployment.Once the database is provisioned, whitelist the EKS cluster's outbound IP in the database firewall rules to allow the cluster to connect to the database.
TroubleshootingEFS mount target not accessible from EKS nodes
Verify that TCP port 2049 is open in the default security group between your EKS nodes and the EFS mount targets. Refer to Creating virtual network for security group configuration.EFS CSI Driver not authorized to mount volumes
This typically means the IAM role annotation is missing or incorrect on the service account. To fix it, repeat the steps given under Step 2: Assign required privileges to the EFS CSI Driver.Storage Class not appearing in cluster
Ensure that kubectl is pointing to the correct EKS cluster. Re-run the aws eks update-kubeconfig command and retry.
Prerequisites​

Prerequisites
