What is the best practices to deploy files in aws EFS from Gitlab CI pipeline?
Currently, we deploy files from gitlab.com to EFS through ssh to one of EC2 instances where EFS is mounted. Is there a better way in doing that? Not very fan in giving ssh access to gitlab to our EC2 instances
If you want the files to end up on EFS, at the end of the day you'll have to write them there from a system, somewhere, that has the EFS volume mounted. There's no way to write to EFS other than writing to the nfs-mounted volume it provides. ( EFS offers the FileSync service, which AFAICT merely wraps the process of creating an EC2 instance and moving to data through it to EFS, but that looks more appropriate for migrations than for ongoing file operations).
That doesn't necessarily mean you have to allow gitlab to ssh in. You could have gitlab stage the files somewhere and notify the system. Or you could have the system poll for changes. But none of these seem as simple as your implementation.
Another option would be to restrict the actions the ssh user can perform. That would take a little sleuthing to determine exactly how the gitlab file copy process functions. If it only uses SFTP or SCP you should be able to restrict the user to just that, and user filesystem permissions can prevent the user from writing to inappropriate locations.
As a general note, I don't see a lot of devops build flows copy code to a shared filesystem these days. NFS is a valid solution for sharing files, but has its own pitfalls. Instead deployment processes usually build a package of some sort, and then deploying the package happens automatically with a deploy hook ( "Continuous Delivery"-style), or the deployment automation is updated manually to upgrade versions. Often the two will be combined to provide a continuous delivery process to development environment, and a manual version setting for production.
