Subpath of EFS Access Point on Lambda

Question

I need to create many lambdas that connect to the same EFS. Considering that files on EFS are arranged something like this:-

- /parentDir
    - /childDir1
    - /childDir2
    - /childDir3
    - ...

Each lambda needs access to only one childDir. Example:- Lambda1 only needs access to parentDir/childDir1. Lambda2 only needs access to parentDir/childDir2 and so on..

The EFS access point has been created for path /parentDir.

All the lambdas are able to use this EFS access point to get access to their desired directories. However, these lambdas are also able to access all the childDirs which is undesirable.

Also, considering that there is a limit of 120 Access Points per EFS, creating a new EFS access point for every lambda also would not be a solution here.

I am aware something similar can be achieved for EKS+EFS using a single EFS Access Point by specifying the EFS Access Point ID in the Persistent Volume's CSI volumeHandle and specifying the subPath for Pod's volumeMount:-

apiVersion: v1
kind: PersistentVolume
...
csi:
    driver: efs.csi.aws.com
    volumeHandle: fs-086d5ec1ad95cd54a::fsap-0015a3496006e9657

apiVersion: v1
kind: Pod
...
    volumeMounts:
    - name: efs-volume-1-apeg
      mountPath: /data
      subPath: childDir3
...

So, is there a way to mount an EFS access point to Lambda in a way that the Lambda can only access a particular subPath(Example:- /parentDir/childDir2) and not all the directories?

Subpath of EFS Access Point on Lambda

0 Answers