Replicating EFS file systems across AWS accounts

You can replicate EFS file systems across AWS accounts. Replicating across accounts enhances the overall resilience and reliability of your disaster recovery (DR) strategies and can help you meet corporate compliance mandates.

For example, you might be required by compliance policies to use different accounts for different environments (such as production, staging, and disaster recovery (DR)). Or you may find that replication across different AWS accounts provides stronger isolation, more granular control over permissions and access policies, and more straightforward auditing of resources. If the production account is compromised (such as by security breaches, misconfiguration, or insider threats), having the DR servers in a separate account can prevent the attacker from accessing them, reduce the blast radius of security incidents, and minimize the risk of unauthorized changes.

Replicating across AWS accounts requires additional security and policy setup. You must create an IAM role on the source account that gives Amazon EFS permission to perform replication in the destination account. You also need to create policies on the file systems that you want to share across accounts. After the IAM role and file system policies are created, you create the replication configuration.

Create an IAM role with a custom trust policy

For Amazon EFS to perform cross-account replication on the source account’s behalf, an IAM role must be created on the source account. The role must have the elasticfilesystem.amazonaws.com trust policy to allow Amazon EFS to assume the role and act as the service principal. The role must contain all of the IAM permissions required to perform replication (see Required IAM permissions) and grant explicit permission to replicate to the file system in the destination account.

Prerequisites

You must create both the source file system and the destination file system in the replication configuration before you can create the IAM role for the source account. You must know and provide the ARN for each file system.

Create policies on the source and destination file systems

To share file systems cross-account in Amazon EFS, you must assign policies to both the destination and source file systems. The policies grant or restrict access across accounts to the file system to which they are applied. Only account owners with permission to edit file systems can assign policies to the file system in their account.

Policy for the destination file system

To allow the source account permission to replicate to the destination file system and to delete the replication configuration from the destination account, the following policy must be created on the destination file system. Replace SOURCE_ACCOUNT_ROOT with the ID of the account that owns the source file system.

{ 
  "Version": "2012-10-17", 
  "Statement": [ 
     { 
        "Sid": "Permissions for source account calls", 
        "Effect": "Allow",
        "Principal": { 
        "AWS": "SOURCE_ACCOUNT_ROOT"
      }, 
    "Action": [ 
         "elasticfilesystem:DescribeFileSystems", 
         "elasticfilesystem:CreateReplicationConfiguration", 
         "elasticfilesystem:DescribeReplicationConfigurations",
         "elasticfilesystem:DeleteReplicationConfiguration", 
         "elasticfilesystem:ReplicationWrite" 
         ], 
     "Resource": "DESTINATION_FILE_SYSTEM_ARN"
     } 
   ]
}

Policy for the source file system

To allow the destination account permission to delete the replication configuration from the source account, you must assign the following policy to the source file system. Replace DESTINATION_ACCOUNT_ROOT with the ID of the account that owns the destination file system.

{
    "Version": "2012-10-17",
    "Id": "efs-policy",
    "Statement": [
        {
            "Sid": "Permission to delete the replication by the destination account",
            "Effect": "Allow",
            "Principal": {
                "AWS": "DESTINATION_ACCOUNT_ROOT"
            },
            "Action": "elasticfilesystem:DeleteReplicationConfiguration",
            "Resource": "SOURCE_FILE_SYSTEM_ARN"
        }
    ]
}  

Create the replication configuration

After you have created the IAM role and added the file system policies to the source and destination file systems, follow the instructions in Configuring replication to an existing EFS file system to create the replication configuration.