Configuring AWS DataSync transfers with Amazon EFS

Open the AWS DataSync console at https://console.aws.amazon.com/datasync/.

In the left navigation pane, expand Data transfer, then choose Locations and Create location.

For Location type, choose Amazon EFS file system.

You configure this location as a source or destination later.

For File system, choose the Amazon EFS file system that you want to use as a location.

You configure this location as a source or destination later.

For Mount path, enter a mount path for your Amazon EFS file system.

This specifies where DataSync reads or writes data (depending on if this is a source or destination location).

By default, DataSync uses the root directory (or access point if you configure one). You can also specify subdirectories using forward slashes (for example, /path/to/directory).

For Subnet choose a subnet where DataSync creates the network interfaces for managing traffic during your transfer.

The subnet must be located:

For Security groups, choose the security groups associated with an Amazon EFS file system's mount target.

For In-transit encryption, choose whether you want DataSync to use Transport Layer Security (TLS) encryption when it copies data to or from your file system.

(Optional) For EFS access point, choose an access point that DataSync can use to mount your Amazon EFS file system.

(Optional) For IAM role, specify a role that allows DataSync to access your file system.

For information on creating this role, see Using IAM policies to access your Amazon EFS file system

(Optional) Select Add tag to tag your file system.

A tag is a key-value pair that helps you manage, filter, and search for your locations.

Choose Create location.

Identify a subnet that has at least one mount target for that file system. You can see all the mount targets and the subnets associated with an EFS file system by using the describe-mount-targets command.

aws efs describe-mount-targets \
    --region aws-region  \
    --file-system-id file-system-id

This command returns information about the target similar to the information shown following.

{
    "MountTargets": [
        {
            "OwnerId": "111222333444",
            "MountTargetId": "fsmt-22334a10",
            "FileSystemId": "fs-123456ab",
            "SubnetId": "subnet-f12a0e34",
            "LifeCycleState": "available",
            "IpAddress": "11.222.0.123",
            "NetworkInterfaceId": "eni-1234a044"
        }
    ]
}

Specify an Amazon EC2 security group that can access the mount target. You can run the following command to find out the security group of the mount target.

aws efs describe-mount-target-security-groups \
    --region aws-region \
    --mount-target-id mount-target-id

The security group that you provide must be able to communicate with the security group on the mount target in the subnet specified.

The relationship between security group M on the mount target and security group S, which you provide for DataSync to use at this stage, is as follows:

Create the location. To create the EFS location, you need the ARNs for your Amazon EC2 subnet, Amazon EC2 security group, and a file system. Because the DataSync API accepts fully qualified ARNs, you can construct these ARNs. For information about how to construct ARNs for different services, see Amazon Resource Names (ARNs) in the AWS General Reference.

Use the following command to create an EFS location.

aws datasync create-location-efs \
    --subdirectory /path/to/your/subdirectory \
    --efs-filesystem-arn 'arn:aws:elasticfilesystem:region:account-id:file-system/filesystem-id' \
    --ec2-config SecurityGroupArns='arn:aws:ec2:region:account-id:security-group/security-group-id',SubnetArn='arn:aws:ec2:region:account-id:subnet/subnet-id'