aws efs connection timeout at mount

Question

I am following this tutorial to mount efs on AWS EC2 instance but when Iam executing the mount command

sudo mount -t nfs4 -o vers=4.1 $(curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone).[EFS-ID].efs.[region].amazonaws.com:/ efs 

I am getting connection time out every time.

mount.nfs4: Connection timed out 

What may be the problem here?

Thanks in advance!

Answer 1

I found the accepted answer here to be incorrect & insecure, and Bao's answer above is very close - except you don't need NFS Inbound on your EC2 (mount target) security group. You just need a security group assigned to your EC2 (even with no rules) so that your EFS Security group can be limited to that security group... you know, for security! Here's what I found works:

• Create a new security group for your EC2 instance. Name it EFS Target, and leave all the rules blank
• Create a new security group for your EFS Mount. Name it EFS Mount, and in this one add the inbound rule for NFS. Set the SOURCE for this rule to the EFS Target security group you created above. This limits EFS to only being able to connect to EC2 instances that have the EFS Mount security group assigned (See below). If you're not worried about that, you can select "Any" from the Source dropdown and it'll work just the same, without the added level of security
• Go to the EC2 console, and add the EFS Target group to your EC2 instance, assuming you're adding the extra security
• Go to the EFS Console, select your EFS and choose Manage File System Access
  • For each EFS Mount Target (availability zone), you need to add the EFS Mount security group and remove the VPC Default group (if you haven't already)
• The mount command in the AWS documentation should work now

I don't like how they mixed vernacular here in terms of EC2 being a mount-target, but also EFS has individual mount-targets for each availability zone. Makes their documentation very confusing, but following the steps above allowed me to mount an EFS securely on an Ubuntu server.

Answer 2

Add type with NFS and port 2049 to the Inbound of your security group that your EC2 instances and EFS running on. It works for me.

Bao