Skip to main content
This guide demonstrates how to create an Amazon Elastic File System (EFS) and mount it on two EC2 instances in different Availability Zones so both servers can simultaneously read and write to the same shared file system. It covers creating the file system, configuring mount targets and security groups, installing the EFS mount helper, mounting the file system on each instance, and persisting the mount across reboots. Prerequisites
  • A VPC with at least two subnets in different Availability Zones (this demo uses us-east-1a and us-east-1b).
  • Two EC2 instances (one in each subnet/AZ) with a security group you control.
  • Appropriate IAM and console access to create EFS resources.

​
Create the EFS file system

From the EFS console choose the “Customize” option so you can review and set details. Key options to consider:
  • Name: e.g., “EFS demo”
  • Storage class: Multi-AZ (redundant across AZs) or One Zone (single AZ)
  • Automatic backups: optional — enable if you want automated backups
  • Lifecycle management: transition to Infrequently Accessed (IA) after a defined age (e.g., 30 days) to reduce costs
  • Encryption: enable encryption at rest if required
  • Throughput & performance modes: choose Elastic vs Provisioned throughput and General Purpose vs Max I/O based on workload
Recommended quick-reference table for the most common selections: Choose the VPC that contains your EC2 instances. EFS will create mount targets in the selected subnets—create mount targets in each AZ you plan to access the file system from to ensure redundancy. When configuring mount targets, select a security group that allows the EC2 instances to reach the EFS mount targets.
Screenshot of the AWS Amazon EFS "Network access" setup page showing VPC selection and mount target configuration. It displays availability zones, subnet IDs, IP address settings and an open security-group dropdown.
After review, create the file system and wait until its state is Available. Note the file system ID (e.g., fs-08de7b8e04f984697) — you will use it when mounting.
A screenshot of the Amazon Web Services Elastic File System (EFS) console showing a file system named "efsdemo" (fs-08de7b8e04f984697). The General panel lists settings like General Purpose performance, Elastic throughput, automatic backups enabled, state "Available," and a metered size of 6.00 KiB.

​
Security group for EFS

Create or select a security group for the EFS mount targets that allows inbound NFS (TCP port 2049) from the EC2 instances’ security group. Restrict the source to the EC2 instances’ security group for better security. Example rule to add to the EFS mount target security group: If you inspect or create the security group in the EC2 console, you should see the inbound rule allowing port 2049 from the EC2 security group.
A screenshot of the Amazon Web Services EC2 Security Groups console showing a list of security groups with one selected (sg-0a98526b591824c14, named efs-sg). The lower pane displays details and inbound rules, and the left sidebar shows related EC2 navigation options.

​
Mount the EFS on EC2 instances

Perform the following steps on each EC2 instance that will access the EFS. Commands below assume Amazon Linux 2; adjust package manager commands for other distributions (for example, use dnf on some Fedora/RHEL derivatives).
  1. Create a mount point directory:
  1. Install the EFS mount helper (amazon-efs-utils):
  1. Mount the EFS using the mount helper. Replace the file system ID with your own (example uses fs-08de7b8e04f984697):
  1. Verify the mount:
Example output:
  1. Verify read/write access across instances:
On Server 1:
On Server 2:
Back on Server 1 you should now see file2 appear. This confirms simultaneous read/write access from multiple EC2 instances.

​
Persist mounts across reboots

To make the EFS mount persistent, add an entry to /etc/fstab using the recommended EFS options. Example /etc/fstab line (replace the FS ID and mount point):
When editing /etc/fstab, verify the entry before rebooting to avoid boot issues. Test the new entry without rebooting using sudo mount -a and confirm the mount succeeds.

​
Troubleshooting tips

  • If mounts fail, confirm:
    • Mount targets exist in the AZs of your EC2 instances.
    • The EFS mount target security group allows inbound TCP/2049 from the EC2 instances’ security group.
    • Network ACLs and route tables allow traffic between instances and the mount targets.
  • Use sudo journalctl -u amazon-efs-mount-watchdog (if available) and dmesg for mount helper logs.
  • Confirm DNS resolution for the EFS endpoint: nslookup fs-08de7b8e04f984697.efs.<region>.amazonaws.com.

​
Summary

  • Create an EFS file system and ensure mount targets exist in the Availability Zones of your EC2 instances.
  • Configure a security group for EFS that allows inbound TCP/2049 from the EC2 instances’ security group and restrict access where possible.
  • Install amazon-efs-utils on each instance, mount the file system, and verify read/write access from multiple servers.
  • Make the mount persistent by adding the recommended /etc/fstab entry and test with sudo mount -a.
This completes the EFS demo showing a shared file system accessible from multiple EC2 instances.

Watch Video