Unable to mount EFS to ECS on fargate

Viewed 1135

trying to mount EFS to ECS Fargate but getting below error while task is being executed. it looks as though it is an IAM issue but crosschecked all the roles and unable to identify the issue. Checked security groups as well.i allowed 2049 port and attached ecs security group to it.

"ResourceInitializationError: failed to invoke EFS utils commands to set up EFS volumes: stderr: b'mount.nfs4: access denied by server while mounting 127.0.0.1:/' : unsuccessful EFS utils command execution; code: 32"

Terraform 0.12 and Fargate 1.4.0

resource "aws_efs_file_system" efs {
  creation_token   = "${var.prefix}-${var.appName}-ecs"
  encrypted        = true
  kms_key_id       = data.aws_kms_key.efs_kms_key.arn
  performance_mode = var.performance_mode
  throughput_mode  = var.throughput_mode
  tags            = var.tags
}


resource "aws_efs_mount_target" efs_mount {

  count           = length(module.vpc_presets.subnet_ids)
  file_system_id  = aws_efs_file_system.efs.id
  subnet_id       = flatten(module.vpc_presets.subnet_ids)[count.index]
  security_groups = data.terraform_remote_state.remote_state_sg.outputs.efs_sg

}
resource "aws_efs_access_point" this  {
  file_system_id = aws_efs_file_system.efs.id
}
data "template_file" jenkins_container_def {
  template = file("${path.module}/templates/jenkins.json.tpl")

  vars = {
    name                = "${var.prefix}-${var.appName}-${var.env}"
    jenkins_controller_port = var.jenkins_port
    jnlp_port           = var.jnlp_port
    source_volume       = "${var.appName}-efs"
    jenkins_home        = "/var/jenkins_home"
    container_image     = var.image
    region              = var.deployment_region
    account_id          = var.account
    log_group           = data.terraform_remote_state.remote_state_ecs.outputs.logs_name
    memory              = var.jenkins_memory
    cpu                 = var.jenkins_cpu
  }
}


resource "aws_ecs_task_definition" jenkins_controller {
  family = var.appName
  task_role_arn            = data.terraform_remote_state.remote_state_iam.outputs.master_task_arn
  execution_role_arn       = data.terraform_remote_state.remote_state_iam.outputs.jenkins_execution_arn
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = var.jenkins_cpu
  memory                   = var.jenkins_memory
  container_definitions    = data.template_file.jenkins_container_def.rendered

  volume {
    name = "${var.appName}-efs"

    efs_volume_configuration {
      file_system_id     = data.terraform_remote_state.remote_state_efs.outputs.efs_fs_id
      transit_encryption = "ENABLED"

      authorization_config {
        access_point_id = flatten(data.terraform_remote_state.remote_state_efs.outputs.efs_access_point_id)[0]
        iam             = "ENABLED"
      }
    }
  }

  tags = var.tags
}

resource "aws_ecs_service" jenkins_controller {
  name = "${var.prefix}-${var.appName}-controller-service"

  task_definition  = aws_ecs_task_definition.jenkins_controller.arn
  cluster          = data.terraform_remote_state.remote_state_ecs.outputs.ecs_cluster_id
  desired_count    = 1
  launch_type      = "FARGATE"
  platform_version = "1.4.0"

  // Assuming we cannot have more than one instance at a time. Ever.
  deployment_maximum_percent         = 100
  deployment_minimum_healthy_percent = 0


  service_registries {
    registry_arn = aws_service_discovery_service.controller.arn
   }

  load_balancer {
    target_group_arn = data.terraform_remote_state.remote_state_alb.outputs.tg_arn
    container_name   = "${var.prefix}-${var.appName}"
    container_port   = 8080
  }

  network_configuration {
    subnets          = flatten([module.vpc_presets.subnet_ids])

    security_groups  = data.terraform_remote_state.remote_state_sg.outputs.ecs_sg
    assign_public_ip = false
  }
  tags           = var.tags
}

2 Answers

I had a related problem because the directory has not yet been created, there is a property in root_directory that allows creating the directory with proper permissions.

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_access_point#creation_info

In the example I use root, but you can set another gid.

resource "aws_efs_access_point" this  {
  file_system_id = aws_efs_file_system.efs.id
  root_directory {
    path = "/desired-directory"
    creation_info {
      owner_gid = 0
      owner_uid = 0
      permissions = "755"
    }
  }
}

It was an IAM policy issue. issues got fixed after changing the policy.

Related