AccessPoint

fileSystem

The opaque string specified in the request to ensure idempotent creation.

clientToken

Specifies the POSIX IDs and permissions to apply when creating the access point's root directory.

If the
root directory specified by `path` does not exist, EFS creates the root directory and applies the
permissions specified here. If the specified `path` does not exist, you must specify `createAcl`.

createAcl

Specifies the path on the EFS file system to expose as the root directory to NFS clients using the access point to access the EFS file system.

path

The full POSIX identity, including the user ID, group ID, and any secondary group IDs, on the access point that is used for all file system operations performed by NFS clients using the access point.

Specify this to enforce a user identity using an access point.

posixUser

The Elastic File System implementation of IFileSystem.

It creates a new, empty file system in Amazon Elastic File System (Amazon EFS).
It also creates mount target (AWS::EFS::MountTarget) implicitly to mount the
EFS file system on an Amazon Elastic Compute Cloud (Amazon EC2) instance or another resource.

create access point from this filesystem.

addAccessPoint

Adds a statement to the resource policy associated with this file system.

A resource policy will be automatically created upon the first call to `addToResourcePolicy`.

Note that this does not work with imported file systems.

addToResourcePolicy

Grant the actions defined in actions to the given grantee on this File System resource.

[disable-awslint:no-grants]

grant

Grant read permissions for this file system to an IAM principal.

[disable-awslint:no-grants]

grantRead

Grant read and write permissions for this file system to an IAM principal.

[disable-awslint:no-grants]

grantReadWrite

As root user, grant read and write permissions for this file system to an IAM principal.

[disable-awslint:no-grants]

grantRootAccess

FileSystem

Allow access from anonymous client that doesn't use IAM authentication.

allowAnonymousAccess

Whether to enable automatic backups for the file system.

enableAutomaticBackups

Defines if the data at rest in the file system is encrypted or not.

encrypted

fileSystemName

File system policy is an IAM resource policy used to control NFS access to an EFS file system.

fileSystemPolicy

The KMS key used for encryption.

This is required to encrypt the data at rest if

kmsKey

A policy used by EFS lifecycle management to transition files to the Infrequent Access (IA) storage class.

lifecyclePolicy

Whether this is a One Zone file system.

If enabled, `performanceMode` must be set to `GENERAL_PURPOSE` and `vpcSubnets` cannot be set.

oneZone

A policy used by EFS lifecycle management to transition files from Infrequent Access (IA) storage class to primary storage class.

outOfInfrequentAccessPolicy

The performance mode that the file system will operate under.

An Amazon EFS file system's performance mode can't be changed after the file system has been created.
Updating this property will replace the file system.

performanceMode

Provisioned throughput for the file system.

This is a required property if the throughput mode is set to PROVISIONED.
Must be at least 1MiB/s.

provisionedThroughputPerSecond

The removal policy to apply to the file system.

removalPolicy

Replication configuration for the file system.

replicationConfiguration

Whether to enable the filesystem's replication overwrite protection or not.

Set false if you want to create a read-only filesystem for use as a replication destination.

replicationOverwriteProtection

Security Group to assign to this file system.

securityGroup

Enum to mention the throughput mode of the file system.

throughputMode

The number of days after files were last accessed in primary storage (the Standard storage class) at which to move them to Archive storage.

Metadata operations such as listing the contents of a directory don't count as file access events.

transitionToArchivePolicy

Which subnets to place the mount target in the VPC.

vpcSubnets

The `AWS::EFS::AccessPoint` resource creates an EFS access point.

An access point is an application-specific view into an EFS file system that applies an operating system user and group, and a file system path, to any file system request made through the access point. The operating system user and group override any identity information provided by the NFS client. The file system path is exposed as the access point's root directory. Applications using the access point can only access data in its own directory and below. To learn more, see [Mounting a file system using EFS access points](https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html) .

This operation requires permissions for the `elasticfilesystem:CreateAccessPoint` action.

CfnAccessPoint

The ID of the EFS file system that the access point applies to.

Accepts only the ID format for input when specifying a file system, for example `fs-0123456789abcedf2` .

fileSystemId

An array of key-value pairs to apply to this resource.

For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .

accessPointTags

The full POSIX identity, including the user ID, group ID, and secondary group IDs on the access point that is used for all file operations by NFS clients using the access point.

The directory on the EFS file system that the access point exposes as the root directory to NFS clients using the access point.

rootDirectory

The `AWS::EFS::FileSystem` resource creates a new, empty file system in Amazon Elastic File System ( Amazon EFS ).

You must create a mount target ( [AWS::EFS::MountTarget](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html) ) to mount your EFS file system on an Amazon EC2 or other AWS cloud compute resource.

CfnFileSystem

For One Zone file systems, specify the AWS Availability Zone in which to create the file system.

Use the format `us-east-1a` to specify the Availability Zone. For more information about One Zone file systems, see [EFS file system types](https://docs.aws.amazon.com/efs/latest/ug/availability-durability.html#file-system-type) in the *Amazon EFS User Guide* .

> One Zone file systems are not available in all Availability Zones in AWS Regions where Amazon EFS is available.

availabilityZoneName

Use the `BackupPolicy` to turn automatic backups on or off for the file system.

backupPolicy

(Optional) A boolean that specifies whether or not to bypass the `FileSystemPolicy` lockout safety check.

The lockout safety check determines whether the policy in the request will lock out, or prevent, the IAM principal that is making the request from making future `PutFileSystemPolicy` requests on this file system. Set `BypassPolicyLockoutSafetyCheck` to `True` only when you intend to prevent the IAM principal that is making the request from making subsequent `PutFileSystemPolicy` requests on this file system. The default value is `False` .

bypassPolicyLockoutSafetyCheck

A Boolean value that, if true, creates an encrypted file system.

When creating an encrypted file system, you have the option of specifying a KmsKeyId for an existing AWS KMS key . If you don't specify a KMS key , then the default KMS key for Amazon EFS , `/aws/elasticfilesystem` , is used to protect the encrypted file system.

The `FileSystemPolicy` for the EFS file system.

A file system policy is an IAM resource policy used to control NFS access to an EFS file system. For more information, see [Using IAM to control NFS access to Amazon EFS](https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html) in the *Amazon EFS User Guide* .

Describes the protection on the file system.

fileSystemProtection

Use to create one or more tags associated with the file system.

Each tag is a user-defined key-value pair. Name your file system on creation by including a `"Key":"Name","Value":"{value}"` key-value pair. Each key must be unique. For more information, see [Tagging AWS resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) in the *AWS General Reference Guide* .

fileSystemTags

The ID of the AWS KMS key to be used to protect the encrypted file system.

This parameter is only required if you want to use a nondefault KMS key . If this parameter is not specified, the default KMS key for Amazon EFS is used. This ID can be in one of the following formats:

- Key ID - A unique identifier of the key, for example `1234abcd-12ab-34cd-56ef-1234567890ab` .
- ARN - An Amazon Resource Name (ARN) for the key, for example `arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab` .
- Key alias - A previously created display name for a key, for example `alias/projectKey1` .
- Key alias ARN - An ARN for a key alias, for example `arn:aws:kms:us-west-2:444455556666:alias/projectKey1` .

If `KmsKeyId` is specified, the `Encrypted` parameter must be set to true.

kmsKeyId

An array of `LifecyclePolicy` objects that define the file system's `LifecycleConfiguration` object.

A `LifecycleConfiguration` object informs Lifecycle management of the following:

- When to move files in the file system from primary storage to IA storage.
- When to move files in the file system from primary storage or IA storage to Archive storage.
- When to move files that are in IA or Archive storage to primary storage.

> Amazon EFS requires that each `LifecyclePolicy` object have only a single transition. This means that in a request body, `LifecyclePolicies` needs to be structured as an array of `LifecyclePolicy` objects, one object for each transition, `TransitionToIA` , `TransitionToArchive` `TransitionToPrimaryStorageClass` . See the example requests in the following section for more information.

lifecyclePolicies

The performance mode of the file system.

We recommend `generalPurpose` performance mode for all file systems. File systems using the `maxIO` performance mode can scale to higher levels of aggregate throughput and operations per second with a tradeoff of slightly higher latencies for most file operations. The performance mode can't be changed after the file system has been created. The `maxIO` mode is not supported on One Zone file systems.

> Due to the higher per-operation latencies with Max I/O, we recommend using General Purpose performance mode for all file systems.

Default is `generalPurpose` .

The throughput, measured in mebibytes per second (MiBps), that you want to provision for a file system that you're creating.

Required if `ThroughputMode` is set to `provisioned` . Valid values are 1-3414 MiBps, with the upper limit depending on Region. To increase this limit, contact Support . For more information, see [Amazon EFS quotas that you can increase](https://docs.aws.amazon.com/efs/latest/ug/limits.html#soft-limits) in the *Amazon EFS User Guide* .

provisionedThroughputInMibps

Describes the replication configuration for a specific file system.

Specifies the throughput mode for the file system.

The mode can be `bursting` , `provisioned` , or `elastic` . If you set `ThroughputMode` to `provisioned` , you must also set a value for `ProvisionedThroughputInMibps` . After you create the file system, you can decrease your file system's Provisioned throughput or change between the throughput modes, with certain time restrictions. For more information, see [Specifying throughput with provisioned mode](https://docs.aws.amazon.com/efs/latest/ug/performance.html#provisioned-throughput) in the *Amazon EFS User Guide* .

Default is `bursting` .

The `AWS::EFS::MountTarget` resource is an Amazon EFS resource that creates a mount target for an EFS file system.

You can then mount the file system on Amazon EC2 instances or other resources by using the mount target.

CfnMountTarget

The ID of the file system for which to create the mount target.

VPC security group IDs, of the form `sg-xxxxxxxx` .

These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see [Amazon VPC Quotas](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html) in the *Amazon VPC User Guide* (see the *Security Groups* table). If you don't specify a security group, then Amazon EFS uses the default security group for the subnet's VPC.

securityGroups

The ID of the subnet to add the mount target in.

For One Zone file systems, use the subnet that is associated with the file system's Availability Zone. The subnet type must be the same type as the `IpAddressType` .

subnetId

If the `IpAddressType` for the mount target is IPv4 ( `IPV4_ONLY` or `DUAL_STACK` ), then specify the IPv4 address to use.

If you do not specify an `IpAddress` , then Amazon EFS selects an unused IP address from the subnet specified for `SubnetId` .

ipAddress

The IP address type for the mount target.

The possible values are `IPV4_ONLY` (only IPv4 addresses), `IPV6_ONLY` (only IPv6 addresses), and `DUAL_STACK` (dual-stack, both IPv4 and IPv6 addresses). If you don’t specify an `IpAddressType` , then `IPV4_ONLY` is used.

> The `IPAddressType` must match the IP type of the subnet. Additionally, the `IPAddressType` parameter overrides the value set as the default IP address for the subnet in the VPC. For example, if the `IPAddressType` is `IPV4_ONLY` and `AssignIpv6AddressOnCreation` is `true` , then IPv4 is used for the mount target. For more information, see [Modify the IP addressing attributes of your subnet](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html) .

ipAddressType

If the `IPAddressType` for the mount target is IPv6 ( `IPV6_ONLY` or `DUAL_STACK` ), then specify the IPv6 address to use.

If you do not specify an `Ipv6Address` , then Amazon EFS selects an unused IP address from the subnet specified for `SubnetId` .

Amazon EFS

L2 Constructs2

AccessPoint

FileSystem

L1 Constructs3

CfnAccessPoint

CfnFileSystem

CfnMountTarget

Learn AWS the Practical Way

Quick Facts

Related Links

More Amazon EFS deep dives