aws-cdk-lib.aws_efs.FileSystem

FileSystem L2 construct

The Elastic File System implementation of IFileSystem.

It creates a new, empty file system in Amazon Elastic File System (Amazon EFS). It also creates mount target (AWS::EFS::MountTarget) implicitly to mount the EFS file system on an Amazon Elastic Compute Cloud (Amazon EC2) instance or another resource.

Construct›Resource›FileSystem

implements

• IResource,
• IConnectable,
• IFileSystem,
• IResourceWithPolicy,
• 5 more

  • IResourceWithPolicyV2,
  • IEnvironmentAware,
  • IFileSystemRef,
  • IConstruct,
  • IDependable

CloudFormation

AWS::EFS::FileSystem

L1 type

CfnFileSystem

Source

aws-efs/lib/efs-file-system.ts

Type last changed

v2.234.0 · 8 Jan 2026

Example

import * as iam from 'aws-cdk-lib/aws-iam';

const role = new iam.Role(this, 'ClientRole', {
  assumedBy: new iam.AnyPrincipal(),
});
const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
  vpc: new ec2.Vpc(this, 'VPC'),
  allowAnonymousAccess: true,
});

fileSystem.grantRead(role);

import aws_cdk.aws_iam as iam


role = iam.Role(self, "ClientRole",
    assumed_by=iam.AnyPrincipal()
)
file_system = efs.FileSystem(self, "MyEfsFileSystem",
    vpc=ec2.Vpc(self, "VPC"),
    allow_anonymous_access=True
)

file_system.grant_read(role)

import software.amazon.awscdk.services.iam.*;


Role role = Role.Builder.create(this, "ClientRole")
        .assumedBy(new AnyPrincipal())
        .build();
FileSystem fileSystem = FileSystem.Builder.create(this, "MyEfsFileSystem")
        .vpc(new Vpc(this, "VPC"))
        .allowAnonymousAccess(true)
        .build();

fileSystem.grantRead(role);

// Install: dotnet add package Amazon.CDK.Lib
using Amazon.CDK.AWS.IAM;


var role = new Role(this, "ClientRole", new RoleProps {
    AssumedBy = new AnyPrincipal()
});
var fileSystem = new FileSystem(this, "MyEfsFileSystem", new FileSystemProps {
    Vpc = new Vpc(this, "VPC"),
    AllowAnonymousAccess = true
});

fileSystem.GrantRead(role);

// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
import "github.com/aws/aws-cdk-go/awscdk"


role := iam.NewRole(this, jsii.String("ClientRole"), &RoleProps{
	AssumedBy: iam.NewAnyPrincipal(),
})
fileSystem := efs.NewFileSystem(this, jsii.String("MyEfsFileSystem"), &FileSystemProps{
	Vpc: ec2.NewVpc(this, jsii.String("VPC")),
	AllowAnonymousAccess: jsii.Boolean(true),
})

fileSystem.grantRead(role)

Initializer

new FileSystem(scope: Construct, id: string, props: FileSystemProps)

FileSystem(scope: Construct, id: str, props: FileSystemProps)

new FileSystem(Construct scope, String id, FileSystemProps props)

new FileSystem(Construct scope, string id, FileSystemProps props)

NewFileSystem(Scope Construct, Id *string, Props FileSystemProps)

Construct Props

allowAnonymousAccess?optionalbooleanallow_anonymous_access?optionalboolallowAnonymousAccess?optionalBooleanAllowAnonymousAccess?optionalboolAllowAnonymousAccess?optional*bool#

Allow access from anonymous client that doesn't use IAM authentication.

Default: false when using grantRead, grantWrite, grantRootAccess or set @aws-cdk/aws-efs:denyAnonymousAccess feature flag, otherwise true

enableAutomaticBackups?optionalbooleanenable_automatic_backups?optionalboolenableAutomaticBackups?optionalBooleanEnableAutomaticBackups?optionalboolEnableAutomaticBackups?optional*bool= false#

Whether to enable automatic backups for the file system.

encrypted?optionalbooleanencrypted?optionalboolencrypted?optionalBooleanEncrypted?optionalboolEncrypted?optional*bool#

Defines if the data at rest in the file system is encrypted or not.

Default: If your application has the '@aws-cdk/aws-efs:defaultEncryptionAtRest' feature flag set, the default is true, otherwise, the default is false.

fileSystemName?optionalstringfile_system_name?optionalstrfileSystemName?optionalStringFileSystemName?optionalstringFileSystemName?optional*string#

The file system's name.

Default: CDK generated name

fileSystemPolicy?optionalPolicyDocumentfile_system_policy?optionalPolicyDocumentfileSystemPolicy?optionalPolicyDocumentFileSystemPolicy?optionalPolicyDocumentFileSystemPolicy?optionalPolicyDocument= none#

File system policy is an IAM resource policy used to control NFS access to an EFS file system.

kmsKey?optionalIKeyRefkms_key?optionalIKeyRefkmsKey?optionalIKeyRefKmsKey?optionalIKeyRefKmsKey?optionalIKeyRef#

The KMS key used for encryption.

Default: if 'encrypted' is true, the default key for EFS (/aws/elasticfilesystem) is used

This is required to encrypt the data at rest if

lifecyclePolicy?optionalLifecyclePolicylifecycle_policy?optionalLifecyclePolicylifecyclePolicy?optionalLifecyclePolicyLifecyclePolicy?optionalLifecyclePolicyLifecyclePolicy?optionalLifecyclePolicy#

A policy used by EFS lifecycle management to transition files to the Infrequent Access (IA) storage class.

Default: None. EFS will not transition files to the IA storage class.

oneZone?optionalbooleanone_zone?optionalbooloneZone?optionalBooleanOneZone?optionalboolOneZone?optional*bool= false#

Whether this is a One Zone file system.

If enabled, performanceMode must be set to GENERAL_PURPOSE and vpcSubnets cannot be set.

outOfInfrequentAccessPolicy?optionalOutOfInfrequentAccessPolicyout_of_infrequent_access_policy?optionalOutOfInfrequentAccessPolicyoutOfInfrequentAccessPolicy?optionalOutOfInfrequentAccessPolicyOutOfInfrequentAccessPolicy?optionalOutOfInfrequentAccessPolicyOutOfInfrequentAccessPolicy?optionalOutOfInfrequentAccessPolicy#

A policy used by EFS lifecycle management to transition files from Infrequent Access (IA) storage class to primary storage class.

Default: None. EFS will not transition files from IA storage to primary storage.

performanceMode?optionalPerformanceModeperformance_mode?optionalPerformanceModeperformanceMode?optionalPerformanceModePerformanceMode?optionalPerformanceModePerformanceMode?optionalPerformanceMode= PerformanceMode.GENERAL_PURPOSE#

The performance mode that the file system will operate under.

An Amazon EFS file system's performance mode can't be changed after the file system has been created. Updating this property will replace the file system.

provisionedThroughputPerSecond?optionalSizeprovisioned_throughput_per_second?optionalSizeprovisionedThroughputPerSecond?optionalSizeProvisionedThroughputPerSecond?optionalSizeProvisionedThroughputPerSecond?optionalSize#

Provisioned throughput for the file system.

Default: none, errors out

This is a required property if the throughput mode is set to PROVISIONED. Must be at least 1MiB/s.

removalPolicy?optionalRemovalPolicyremoval_policy?optionalRemovalPolicyremovalPolicy?optionalRemovalPolicyRemovalPolicy?optionalRemovalPolicyRemovalPolicy?optionalRemovalPolicy= RemovalPolicy.RETAIN#

The removal policy to apply to the file system.

replicationConfiguration?optionalReplicationConfigurationreplication_configuration?optionalReplicationConfigurationreplicationConfiguration?optionalReplicationConfigurationReplicationConfiguration?optionalReplicationConfigurationReplicationConfiguration?optionalReplicationConfiguration#

Replication configuration for the file system.

Default: no replication

replicationOverwriteProtection?optionalReplicationOverwriteProtectionreplication_overwrite_protection?optionalReplicationOverwriteProtectionreplicationOverwriteProtection?optionalReplicationOverwriteProtectionReplicationOverwriteProtection?optionalReplicationOverwriteProtectionReplicationOverwriteProtection?optionalReplicationOverwriteProtection#

Whether to enable the filesystem's replication overwrite protection or not.

Default: ReplicationOverwriteProtection.ENABLED

Set false if you want to create a read-only filesystem for use as a replication destination.

securityGroup?optionalISecurityGroupsecurity_group?optionalISecurityGroupsecurityGroup?optionalISecurityGroupSecurityGroup?optionalISecurityGroupSecurityGroup?optionalISecurityGroup#

Security Group to assign to this file system.

Default: creates new security group which allows all outbound traffic

throughputMode?optionalThroughputModethroughput_mode?optionalThroughputModethroughputMode?optionalThroughputModeThroughputMode?optionalThroughputModeThroughputMode?optionalThroughputMode= ThroughputMode.BURSTING#

Enum to mention the throughput mode of the file system.

transitionToArchivePolicy?optionalLifecyclePolicytransition_to_archive_policy?optionalLifecyclePolicytransitionToArchivePolicy?optionalLifecyclePolicyTransitionToArchivePolicy?optionalLifecyclePolicyTransitionToArchivePolicy?optionalLifecyclePolicy#

The number of days after files were last accessed in primary storage (the Standard storage class) at which to move them to Archive storage.

Default: None. EFS will not transition files to Archive storage class.

Metadata operations such as listing the contents of a directory don't count as file access events.

vpcIVpcvpcIVpcvpcIVpcVpcIVpcVpcIVpcrequired#

VPC to launch the file system in.

vpcSubnets?optionalSubnetSelectionvpc_subnets?optionalSubnetSelectionvpcSubnets?optionalSubnetSelectionVpcSubnets?optionalSubnetSelectionVpcSubnets?optionalSubnetSelection#

Which subnets to place the mount target in the VPC.

Default: the Vpc default strategy if not specified

Properties

connectionsConnectionsconnectionsConnectionsconnectionsConnectionsConnectionsConnectionsConnectionsConnections#

The security groups/rules used to allow network connections to the file system.

DEFAULT_PORTnumberdefault_portint | floatDEFAULT_PORTNumberDEFAULT_PORTdoubleDEFAULT_PORT*float64static#

The default port File System listens on.

envResourceEnvironmentenvResourceEnvironmentenvResourceEnvironmentEnvResourceEnvironmentEnvResourceEnvironment#

The environment this resource belongs to.

notes

For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.

For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.

fileSystemArnstringfile_system_arnstrfileSystemArnStringFileSystemArnstringFileSystemArn*string#

The ARN of the file system.

fileSystemIdstringfile_system_idstrfileSystemIdStringFileSystemIdstringFileSystemId*string#

The ID of the file system, assigned by Amazon EFS.

fileSystemRefFileSystemReferencefile_system_refFileSystemReferencefileSystemRefFileSystemReferenceFileSystemRefFileSystemReferenceFileSystemRefFileSystemReference#

A reference to a FileSystem resource.

mountTargetsAvailableIDependablemount_targets_availableIDependablemountTargetsAvailableIDependableMountTargetsAvailableIDependableMountTargetsAvailableIDependable#

Dependable that can be depended upon to ensure the mount targets of the filesystem are ready.

nodeNodenodeNodenodeNodeNodeNodeNodeNode#

The tree node.

PROPERTY_INJECTION_IDstringproperty_injection_idstrPROPERTY_INJECTION_IDStringPROPERTY_INJECTION_IDstringPROPERTY_INJECTION_ID*stringstatic#

Uniquely identifies this class.

stackStackstackStackstackStackStackStackStackStack#

The stack in which this resource is defined.

Methods

addAccessPoint(id: string, accessPointOptions?: AccessPointOptions): AccessPointdef add_access_point(self, id: str, access_point_options: typing.Optional[AccessPointOptions] = None) -> AccessPointpublic AccessPoint addAccessPoint(String id, AccessPointOptions accessPointOptions)public AccessPoint AddAccessPoint(string id, AccessPointOptions? accessPointOptions = null)func AddAccessPoint(Id *string, AccessPointOptions AccessPointOptions) AccessPoint#

create access point from this filesystem.

addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResultdef add_to_resource_policy(self, statement: PolicyStatement) -> AddToResourcePolicyResultpublic AddToResourcePolicyResult addToResourcePolicy(PolicyStatement statement)public AddToResourcePolicyResult AddToResourcePolicy(PolicyStatement statement)func AddToResourcePolicy(Statement PolicyStatement) AddToResourcePolicyResult#

Adds a statement to the resource policy associated with this file system.

A resource policy will be automatically created upon the first call to addToResourcePolicy.

Note that this does not work with imported file systems.

1 parameter

Parameters

• statementstatementstatementstatementStatement — The policy statement to add.

applyCrossStackReferenceStrength(strength: ReferenceStrength): voiddef apply_cross_stack_reference_strength(self, strength: ReferenceStrength) -> Nonepublic void applyCrossStackReferenceStrength(ReferenceStrength strength)public void ApplyCrossStackReferenceStrength(ReferenceStrength strength)func ApplyCrossStackReferenceStrength(Strength ReferenceStrength)#

Override the cross-stack reference strength for this resource.

notes · 1 parameter

When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the @aws-cdk/core:defaultCrossStackReferences context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default.

Parameters

• strengthstrengthstrengthstrengthStrength — - The reference strength to use for this resource.

applyRemovalPolicy(policy: RemovalPolicy): voiddef apply_removal_policy(self, policy: RemovalPolicy) -> Nonepublic void applyRemovalPolicy(RemovalPolicy policy)public void ApplyRemovalPolicy(RemovalPolicy policy)func ApplyRemovalPolicy(Policy RemovalPolicy)#

Apply the given removal policy to this resource.

notes

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

fromFileSystemAttributes(scope: Construct, id: string, attrs: FileSystemAttributes): IFileSystem@staticmethod def from_file_system_attributes(scope: Construct, id: str, attrs: FileSystemAttributes) -> IFileSystempublic static IFileSystem fromFileSystemAttributes(Construct scope, String id, FileSystemAttributes attrs)public static IFileSystem FromFileSystemAttributes(Construct scope, string id, FileSystemAttributes attrs)func FromFileSystemAttributes(Scope Construct, Id *string, Attrs FileSystemAttributes) IFileSystemstatic#

Import an existing File System from the given properties.

grant(grantee: IGrantable, ...actions: string[]): Grantdef grant(self, grantee: IGrantable, actions: str) -> Grantpublic Grant grant(IGrantable grantee, String actions)public Grant Grant(IGrantable grantee, string actions)func Grant(Grantee IGrantable, Actions *string) Grant#

Grant the actions defined in actions to the given grantee on this File System resource.

[disable-awslint:no-grants]

2 parameters

Parameters

• granteegranteegranteegranteeGrantee — Principal to grant right to.
• actionsactionsactionsactionsActions — The actions to grant.

grantRead(grantee: IGrantable): Grantdef grant_read(self, grantee: IGrantable) -> Grantpublic Grant grantRead(IGrantable grantee)public Grant GrantRead(IGrantable grantee)func GrantRead(Grantee IGrantable) Grant#

Grant read permissions for this file system to an IAM principal.

[disable-awslint:no-grants]

1 parameter

Parameters

• granteegranteegranteegranteeGrantee — The principal to grant read to.

grantReadWrite(grantee: IGrantable): Grantdef grant_read_write(self, grantee: IGrantable) -> Grantpublic Grant grantReadWrite(IGrantable grantee)public Grant GrantReadWrite(IGrantable grantee)func GrantReadWrite(Grantee IGrantable) Grant#

Grant read and write permissions for this file system to an IAM principal.

[disable-awslint:no-grants]

1 parameter

Parameters

• granteegranteegranteegranteeGrantee — The principal to grant read and write to.

grantRootAccess(grantee: IGrantable): Grantdef grant_root_access(self, grantee: IGrantable) -> Grantpublic Grant grantRootAccess(IGrantable grantee)public Grant GrantRootAccess(IGrantable grantee)func GrantRootAccess(Grantee IGrantable) Grant#

As root user, grant read and write permissions for this file system to an IAM principal.

[disable-awslint:no-grants]

1 parameter

Parameters

• granteegranteegranteegranteeGrantee — The principal to grant root access to.

isConstruct(x: any): boolean@staticmethod def is_construct(x: Any) -> boolpublic static Boolean isConstruct(Object x)public static bool IsConstruct(object x)func IsConstruct(X interface{}) *boolstatic#

Checks if `x` is a construct.

notes · 1 parameter · returns

Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.

Parameters

• xxxxX — Any object.

Returns: true if x is an object created from a class which extends Construct.

isOwnedResource(construct: IConstruct): boolean@staticmethod def is_owned_resource(construct: IConstruct) -> boolpublic static Boolean isOwnedResource(IConstruct construct)public static bool IsOwnedResource(IConstruct construct)func IsOwnedResource(Construct IConstruct) *boolstatic#

Returns true if the construct was created by CDK, and false otherwise.

isResource(construct: IConstruct): boolean@staticmethod def is_resource(construct: IConstruct) -> boolpublic static Boolean isResource(IConstruct construct)public static bool IsResource(IConstruct construct)func IsResource(Construct IConstruct) *boolstatic#

Check whether the given construct is a Resource.

toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#

Returns a string representation of this construct.

with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#

Applies one or more mixins to this construct.

Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.