How do I get write access to EFS from Lambda?

Question

I've created a lambda function. I created a Elastic File System (EFS) and access points using all the default settings. I attached the EFS to the lambda function, again just using the defaults.

But! There is no write access to EFS.

What did I miss?

Hope some kind person knows :)

Notes....

The current answer doesn't seem to work. I've also been onto AWS support for over a week. They seem to think the EFS is not mounting.

EFS is mounted to lambda at = /mnt/fs

EFS Access point - Root Directory Path = / (A suggestion of changing this to /fs causes an internal server error, AWS support suggested /mnt/fs which also causes an internal service error).

AmazonElasticFileSystemClientFullAccess and AWSLambdaVPCAccessExecutionRole added to execution role.

Test Node js example:

exports.handler = function(event, ctx, callback) {
    const fs = require("fs");
    fs.mkdir('/mnt/fs/newfolder', { recursive: true }, (err) => {
        callback(null, {
            statusCode: 200,
            "content-type": "text/html",
            body: (err || "ok").toString()
        })
    });
};

Hi Gordon, did you ever find an answer? I have been stuck on this for many hours now. Just trying to save an img to EFS from Lambda and have tried all the suggestions. Still getting a Permission Error. Thanks for posting your question! — Luke Buthman, Sep 24 '21 at 23:56
@LukeButhman My answer is the 2nd answer. I've since given up on AWS and moved to app engine on google cloud as it's a lot easier. — Gordon Truslove, Sep 27 '21 at 08:10

score 11 · Answer 1 · answered Feb 22 '21 at 08:21

11

The aws documentation misses the part about posix user settings, but a blog post explains it.

To add EFS to lambda.

AmazonElasticFileSystemClientFullAccess and AWSLambdaVPCAccessExecutionRole permissions need to be added to the execution role.

EFS is mounted to lambda at = /mnt/fs EFS Access point path = /mnt/fs

Add a posix user to the acccess point. User 1000, group 1000 & permissions 0777.

As explained in this blog post:

https://aws.amazon.com/blogs/compute/using-amazon-efs-for-aws-lambda-in-your-serverless-applications/

answered Feb 22 '21 at 08:21

Gordon Truslove

257
3
10

thank you. adding user, group and permission help me a lot – amarynets Nov 03 '21 at 13:40
2

"Add a posix user to the acccess point. User 1000, group 1000 & permissions 0777" helped to solve my mounting problem. – Henry Luo Nov 10 '22 at 08:56

Atul Sharma · Answer 2 · 2020-12-03T21:25:59.803

7

Your Lambda execution role must have AmazonElasticFileSystemClientFullAccess attached to it, to write EFS.

To Add, Go to Lambda > Permission > Execution role and click on the role name.

Now, the role will get opened,Click on Add Policy under permissions and add AmazonElasticFileSystemClientFullAccess and AWSLambdaVPCAccessExecutionRole

Also verify if you have properly set root directory path and mount point in Lambda & EFS Access point.

If mount point in lambda File System is /mnt/fs/ then your Root directory path in Access point must be /fs

edited Dec 03 '20 at 21:25

answered Dec 03 '20 at 21:09

Atul Sharma

9,397
10
38
65

ok, added that. Still no access though. Does it take a while? – Gordon Truslove Dec 03 '20 at 21:16
No its instant. Did cloud-watch logs show any error ? – Atul Sharma Dec 03 '20 at 21:17
Just this: Error: EACCES: permission denied, mkdir '/mnt/fs/newfolder', I mounted EFS at /mnt/fs. – Gordon Truslove Dec 03 '20 at 21:21
Please verify the root directory path and mount point, updated the answer for same. – Atul Sharma Dec 03 '20 at 21:26
1

Your root directory path must be `/fs` in EFS Access point. – Atul Sharma Dec 03 '20 at 21:29
On the access point it says the "Root directory path" is /. – Gordon Truslove Dec 03 '20 at 21:32
1

It must be `/fs` as your lambda mount point is `/mnt/fs` – Atul Sharma Dec 03 '20 at 21:33
3

I've changed the "Root directory path" to /fs and /mnt/fs. Both cause Lambda server errors. If I change it back to / then lambda works again, but back to square one, no file access. – Gordon Truslove Dec 03 '20 at 21:48

score 0 · Answer 3 · answered Sep 25 '21 at 14:55

I had a similar problem and followed all the steps listed here, but nothing resolved it.
After further exploration, I discovered that when DataSync migrated files from S3 to EFS, it also changed the permissions on the EFS folder.

I was able to resolve this by creating an EC2, mounting EFS, and chown on the directory. I could then save as before.

score 0 · Answer 4 · answered Apr 19 '23 at 13:35

I had same problem that efs was read-only from lambda. I mapped efs to a ec2 linux instance and found that all files in this efs had "root" ownership. I think this was automatically done when "/" path was created in efs (maybe because I didn't specify USER/GROUP/permissions).

For example when I was logged as ec2-user (default user of the instance) I was able to read efs but not write , obviously because ec2-user isn't root. The permissions for the folders were drwxr-xr-x, which means only root was able to write and nobody else. Two different fixes both worked well: (a) sudo chmod -R 777 efs (b) sudo chown -R efs But 'b' is better as it changes ownershipt to ec2-user which also allows me to work with efs files from ec2 instance without 'sudo' Hope it helps!!

How do I get write access to EFS from Lambda?

4 Answers4

Linked