Shared file storage: EFS and FSx for Windows

Start as usual, with the Session Manager endpoints:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$env:Path += ';C:\Program Files\Amazon\SessionManagerPlugin\bin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
.\Start-SsmEndpoints.ps1

1Create the security group and the file system

Paste this whole block:

$efsSg = aws ec2 create-security-group --group-name saat-efs-sg --description "NFS from app servers" --vpc-id $v.VpcId --query GroupId --output text
aws ec2 authorize-security-group-ingress --group-id $efsSg --protocol tcp --port 2049 --source-group $v.AppSg | Out-Null
$fs = aws efs create-file-system --creation-token "saat-efs-$(Get-Date -Format yyyyMMddHHmm)" --encrypted --performance-mode generalPurpose --throughput-mode elastic --tags Key=Name,Value=saat-efs Key=course,Value=saatvedha-aws Key=lesson,Value=22 --query FileSystemId --output text
do { Start-Sleep 5; $st = aws efs describe-file-systems --file-system-id $fs --query "FileSystems[0].LifeCycleState" --output text } until ($st -eq 'available')
"$fs $st"

You should see something like this:

fs-0a1b2c3d4e5f67890 available

You never chose a size. EFS bills for what you store, and an empty file system costs almost nothing.

2Add a mount target in each zone

Paste this whole block (about two minutes):

foreach ($s in @($v.PrivateA, $v.PrivateB)) { aws efs create-mount-target --file-system-id $fs --subnet-id $s --security-groups $efsSg | Out-Null }
do { Start-Sleep 15; $states = aws efs describe-mount-targets --file-system-id $fs --query "MountTargets[].LifeCycleState" --output text } until ($states -notmatch 'creating')
aws efs describe-mount-targets --file-system-id $fs --query "MountTargets[].[AvailabilityZoneName,IpAddress,LifeCycleState]" --output text

You should see something like this:

ap-south-1a     10.20.11.140    available
ap-south-1b     10.20.12.190    available

3Launch two servers that mount it at boot

Paste this whole block:

$ud = @'
#!/bin/bash
dnf install -y amazon-efs-utils
mkdir -p /shared
echo "FS_ID:/ /shared efs _netdev,tls,nofail 0 0" >> /etc/fstab
mount -a
'@ -replace 'FS_ID', $fs
[IO.File]::WriteAllText('C:\aws-lab\efs-userdata.sh', ($ud -replace "`r`n", "`n"))
$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$a, $b = foreach ($s in @(@('efs-a', $v.PrivateA), @('efs-b', $v.PrivateB))) {
  aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $s[1] --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --user-data file://efs-userdata.sh --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=$($s[0])},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=22}]" --query "Instances[0].InstanceId" --output text
}
foreach ($i in @($a, $b)) { do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$i" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online') }
aws ssm start-session --target $b --document-name AWS-StartInteractiveCommand --parameters command="cloud-init status --wait"
aws ssm start-session --target $a --document-name AWS-StartInteractiveCommand --parameters command="df -hT /shared"

You should see something like this (session lines left out):

status: done
Filesystem     Type  Size  Used Avail Use% Mounted on
127.0.0.1:/    nfs4  8.0E     0  8.0E   0% /shared

8.0E (exabytes) is EFS saying “no practical limit”. The _netdev and nofail options mean the server waits for the network and still boots if EFS is unreachable, which saves you from instances stuck at boot.

4Write on one server, read on the other

Paste this whole block:

aws ssm start-session --target $a --document-name AWS-StartInteractiveCommand --parameters command="sudo cp /etc/hostname /shared/written-by.txt"
aws ssm start-session --target $b --document-name AWS-StartInteractiveCommand --parameters command="cat /shared/written-by.txt"
aws efs put-lifecycle-configuration --file-system-id $fs --lifecycle-policies TransitionToIA=AFTER_30_DAYS TransitionToArchive=AFTER_90_DAYS TransitionToPrimaryStorageClass=AFTER_1_ACCESS

You should see something like this:

ip-10-20-11-73.ap-south-1.compute.internal
{
    "LifecyclePolicies": [
        {
            "TransitionToIA": "AFTER_30_DAYS"
        },
        {
            "TransitionToArchive": "AFTER_90_DAYS"
        },
        {
            "TransitionToPrimaryStorageClass": "AFTER_1_ACCESS"
        }
    ]
}

efs-b, in another zone, read the hostname efs-a wrote. The lifecycle policy moves cold files to cheaper classes and brings a file back to Standard the first time someone reads it.

✅ Checkpoint: saat-efs has available mount targets in ap-south-1a and ap-south-1b, both servers mount /shared at boot over TLS, a file written on efs-a is readable on efs-b, and lifecycle tiers are set. Keep everything for the break lab.