ECS: Mount EFS volume

I want to be able to create an EFS volume and mount it in a docker container with CDK.

I tried figuring out how to use an Access Point but can’t figure out how to specify the AP ID in a Volume definition. Don’t see anything about access points in ECS docs. I tried creating an EFS volume and mounting it but I can’t write to it and I have no way to change the permissions. I’m using a community docker image I’d rather use as-is without modifying.

Surely this is a common use case - create a writeable persistent volume and mount it.

Use Case

I’m building this - https://github.com/jetbridge/lemmy-cdk

Proposed Solution

A way to mount an EFS access point in a fargate task definition or a way to mount the entire EFS volume as writeable.

Other

const fs = new FileSystem(this, "FS", {
      vpc,
      encrypted: true,
      lifecyclePolicy: LifecyclePolicy.AFTER_60_DAYS,
      performanceMode: PerformanceMode.GENERAL_PURPOSE,
      removalPolicy: RemovalPolicy.RETAIN,
      fileSystemName: "LemmyFS",
      enableAutomaticBackups: false,
    });

    const assetVolume: Volume = {
      efsVolumeConfiguration: {
        fileSystemId: fs.fileSystemId,
      },
      name: "assets",
    };


    const container = taskDef.addContainer(PICTRS_NAME, {
      image: ContainerImage.fromRegistry(PICTRS_IMAGE),
      logging: LogDriver.awsLogs({ streamPrefix: PICTRS_NAME }),
      environment: { PICTRS_PATH: "/mnt/assets" },
    });
    // mount asset storage volume
    container.addMountPoints({
      sourceVolume: assetVolume.name,
      containerPath: "/mnt/assets",
      readOnly: false,
    });

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[Kitenite]

Since this was frustrating for me and I don’t see the full solution here, here’s what worked for me. Permission needs to be added and access point mounts needed to be created. See example below:

  
    mountDirectoryToContainers() {
        const sourceVolume = "SdSourceVolume";
        const sourcePath = "/data";

        const fileSystem = new FileSystem(this, `${APP_NAME}FileSystem`, {
            vpc: this.vpc,
            encrypted: true,
            lifecyclePolicy: LifecyclePolicy.AFTER_14_DAYS,
            performanceMode: PerformanceMode.GENERAL_PURPOSE,
            throughputMode: ThroughputMode.BURSTING,
            removalPolicy: RemovalPolicy.DESTROY
        });

        fileSystem.connections.allowDefaultPortFrom(this.ecsService.connections);

        const efsAccessPoint = fileSystem.addAccessPoint('AccessPoint');
        efsAccessPoint.node.addDependency(fileSystem);

        const efsMountPolicy = (new PolicyStatement({
            actions: [
                'elasticfilesystem:ClientMount',
                'elasticfilesystem:ClientWrite',
                'elasticfilesystem:ClientRootAccess'
            ], 
            resources: [
                efsAccessPoint.accessPointArn,
                fileSystem.fileSystemArn
            ]
        }))

        this.taskDefinition.addToTaskRolePolicy(efsMountPolicy)
        // This policy permission is probably not necessary.
        this.taskDefinition.addToExecutionRolePolicy(efsMountPolicy)

        this.taskDefinition.addVolume({
            name: sourceVolume,
            efsVolumeConfiguration: {
                fileSystemId: fileSystem.fileSystemId,
                transitEncryption: 'ENABLED',
                authorizationConfig: {
                    accessPointId: efsAccessPoint.accessPointId,
                }
            },
        });

        this.downloadContainer.addMountPoints({
            containerPath: sourcePath,
            sourceVolume,
            readOnly: false,
        });
        
        this.inferenceContainer.addMountPoints({
            containerPath: sourcePath,
            sourceVolume,
            readOnly: false,
        });
    }

[JoelVenable]

First, ensure you are using an up-to-date CDK version for the latest features.

I didn’t wind up going this direction so I don’t have a working example, but it looks like the pathway is:

1. use the addVolume method on the TaskDefinition, and provide an efsVolumeConfiguration.
2. use the addMountPoints method on the ContainerDefinition, ensuring the name property is the same between the two methods.