Amazon EFS Finally Clicked for Me: Mount Targets, ENIs, and Security Groups
After completing an AWS SimuLearn lab, I finally understood how EC2 actually reaches Amazon EFS, why Mount Targets exist, and why Security Groups can be attached to them. Here are the mental models that made EFS click for me.
I recently completed the AWS SimuLearn: File Systems in the Cloud lab, and one part of the exercise completely changed the way I think about Amazon EFS.
👉 Lab: https://skillbuilder.aws/learn/A5M8X2CHM3/aws-simulearn-file-systems-in-the-cloud/RAJVAUNMHR?parentId=1UQVR262ZB
Before this lab, my understanding was basically:
Amazon EFS = shared storage that multiple EC2 instances can use.
That is correct, but I still couldn't clearly visualize how an EC2 instance inside a VPC actually connects to EFS.
After doing the lab, a few things finally clicked.
1. EFS is Regional, but EC2 still needs a network path to reach it
Amazon EFS is a Regional managed file system.
My EC2 instance, however, runs inside a subnet in a VPC.
So the question I had was:
How does EC2 actually reach the EFS file system?
This is where the EFS Mount Target comes in.
An EFS Mount Target provides an Elastic Network Interface (ENI) with a private IP address inside a subnet.
My mental model is now:
EC2 → EFS Mount Target → Amazon EFS
I like to think of the Mount Target as a private network doorway to EFS.
It is not a VPC Gateway Endpoint or AWS PrivateLink, but thinking of it as the network entry point helped me understand why it exists.
2. The Mount Target made ENIs finally click for me
This was probably my biggest “aha!” moment from the lab.
The Mount Target is not just an abstract EFS configuration.
It is represented in the VPC through an ENI with a private IP address.
Once I understood that, another AWS concept also became much clearer to me:
Security Groups.
3. Security Groups made much more sense after this
I used to mentally associate a Security Group directly with an EC2 instance:
EC2 → Security Group
But now I understand it better through the networking layer.
An EC2 instance uses an ENI for network connectivity.
An EFS Mount Target also has an ENI.
That means the Mount Target can also have a Security Group controlling the traffic that reaches it.
Amazon EFS uses NFS over TCP port 2049.
A typical flow looks like this:
1
2
3
4
5
6
7
8
9
10
11
12
EC2 Instance
|
| EC2 Security Group
|
| TCP 2049
v
EFS Mount Target
|
| EFS Security Group
| ENI + Private IP
v
Amazon EFSFor example, the EFS Security Group can allow:
1
2
3
4
Type: NFS
Protocol: TCP
Port: 2049
Source: EC2 Security GroupInstead of allowing access from a large IP range, we can allow NFS traffic specifically from the Security Group used by the EC2 instances that need access to EFS.
That helped me realize that working with EFS is not only about storage.
Networking is also a key part of the architecture.
4. The Linux mount command also became easier to understand
During the lab, I first created a directory:
1
mkdir dataAt this point,
data is simply a local directory on that EC2 instance.Then I mounted the EFS file system:
1
mount -t efs -o tls fs-xxxxxxxx:/ dataNow the
data directory becomes the location where that EC2 instance accesses the EFS file system.If I have another EC2 instance, I need to mount EFS on that instance as well.
For example:
1
2
3
EC2-A /data ──┐
├── Amazon EFS
EC2-B /data ──┘The mount points exist separately on each EC2 instance, but both instances can access the same shared files stored in EFS.
The mental model I'll keep
Before the lab:
EFS = shared file storage
After the lab:
EFS = Regional shared file system + Mount Targets + ENIs + Security Groups + NFS
The architecture I now picture in my head is:
1
2
3
4
5
6
7
8
9
10
11
12
13
EC2
↓
ENI
↓
Security Group
↓
EFS Mount Target
↓
ENI + Private IP
↓
NFS TCP/2049
↓
Amazon EFSSometimes a hands-on lab makes one small concept click, and suddenly several AWS concepts connect together.
For me, this lab wasn't only about learning Amazon EFS.
It also helped me understand ENIs, Security Groups, and VPC networking much better.
If you've learned Amazon EFS before, what part was the most confusing at first — Mount Targets, NFS, or Security Groups?
#AWS #AmazonEFS #EC2 #AWSCloud #AWSSkillBuilder #AWSSimuLearn #AWSNetworking #CloudComputing #LearningInPublic
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article