How do I get write access to EFS from Lambda?

Question

I've created a lambda function. I created a Elastic File System (EFS) and access points using all the default settings. I attached the EFS to the lambda function, again just using the defaults.

But! There is no write access to EFS.

What did I miss?

Hope some kind person knows :)

Notes....

The current answer doesn't seem to work. I've also been onto AWS support for over a week. They seem to think the EFS is not mounting.

EFS is mounted to lambda at = /mnt/fs

EFS Access point - Root Directory Path = / (A suggestion of changing this to /fs causes an internal server error, AWS support suggested /mnt/fs which also causes an internal service error).

AmazonElasticFileSystemClientFullAccess and AWSLambdaVPCAccessExecutionRole added to execution role.

Test Node js example:

exports.handler = function(event, ctx, callback) {
    const fs = require("fs");
    fs.mkdir('/mnt/fs/newfolder', { recursive: true }, (err) => {
        callback(null, {
            statusCode: 200,
            "content-type": "text/html",
            body: (err || "ok").toString()
        })
    });
};

user_13566625 · Answer

The aws documentation misses the part about posix user settings, but a blog post explains it.

To add EFS to lambda.

AmazonElasticFileSystemClientFullAccess and AWSLambdaVPCAccessExecutionRole permissions need to be added to the execution role.

EFS is mounted to lambda at = /mnt/fs EFS Access point path = /mnt/fs

Add a posix user to the acccess point. User 1000, group 1000 & permissions 0777.

As explained in this blog post:

https://aws.amazon.com/blogs/compute/using-amazon-efs-for-aws-lambda-in-your-serverless-applications/

user_2528083 · Answer

Your Lambda execution role must have AmazonElasticFileSystemClientFullAccess attached to it, to write EFS.

To Add, Go to Lambda > Permission > Execution role and click on the role name.

Now, the role will get opened,Click on Add Policy under permissions and add AmazonElasticFileSystemClientFullAccess and AWSLambdaVPCAccessExecutionRole

Also verify if you have properly set root directory path and mount point in Lambda & EFS Access point.

If mount point in lambda File System is /mnt/fs/ then your Root directory path in Access point must be /fs

user_7779733 · Answer

I had a similar problem and followed all the steps listed here, but nothing resolved it.
After further exploration, I discovered that when DataSync migrated files from S3 to EFS, it also changed the permissions on the EFS folder.

I was able to resolve this by creating an EC2, mounting EFS, and chown on the directory. I could then save as before.

How do I get write access to EFS from Lambda?

3 Answers