Trouble mounting EFS Access Point to ECS Volume

user_4781364 0
Viewed 1871

I ran into a problem trying to mount an ECS Volume to EFS through an EFS access point.

The task role is set up with ClientWrite, ClientRead, and ClientRootAccess to that file system.

The access point is setup with posix userid 1001 and groupid 1001 with permission 755.

The cluster and the file system are in the correct VPC.

But ECS failed to spin up a task with this error:

Error response from daemon: failed to copy file info for /var/lib/ecs/volumes/{{task-name}}: failed to chown /var/lib/ecs/volumes/{{task-name}}

I was able to spin up the task if i set the access point's POSIX userid and groupid to 0 as in root. But i feel like its not the best choice for security reason in a shared FS.

After some general searches I form a hypothesis that after mounting the volume, the user of the container or its host was changed from root, which mess with the any further file/directory manipulation from the Dockerfile. AWS Access Points docs stated that:

When user enforcement is enabled, Amazon EFS replaces the NFS client's user and group IDs with the identity configured on the access point for all file system operations.

And because I think /var/lib/ecs/volumes/... is actually either the container or the host directory.

How could I circumvent this problem?

fyi: the task is run in a spot instance cluster so manually mount the volume is not an ideal solution in this case

amazon-efs amazon-ecs devops docker amazon-web-services
2 Answers

Is it possible that you have a mismatch between the defined uid/gid in the Docker image you're trying to run and the 1001/1001 uid/gid you are attempting to use?

We ran into this same error when we took a base image, which had volumes defined, and tried to alter the primary user's uid in the image. Since you can't alter file ownership or permissions of a volume, once its been created, the docker daemon would attempt to apply the original uid ownership to the mounted EFS volume, causing the EFS access point to block the change in ownership/permissions.

You can check this by shelling into the docker container locally or running a docker exec to ls -la /path/to/container/folder and check if the ownership of that folder is set to your user with uid 1001.

user_93615550

I ran into the same issue recently. I have an EFS with an accesspoint that allows 755 access to 1001:1001 (ec2-user).

Mounting and accessing via AP worked, but I got the same error using volumes and mounting them in ECS.

In the end the quick and easy fix for me was to add root permissions ("elasticfilesystem:ClientRootAccess") to the file system policy.

user_8688540
Related