3 ms·
sharp knife to hand people -- because EFS is just NFS, it uses NFS for security / isolation. Everything that can mount a given volume needs to agree on what un
by philsnow 6y ago
sharp knife to hand people -- because EFS is just NFS, it uses NFS for security / isolation. Everything that can mount a given volume needs to agree on what unix users are what, and you need to make sure to completely lock down root access, otherwise you can't enforce any kind of data isolation.
If your use case can deal with one EFS volume per isolation boundary, you can use IAM to control who can mount what volume, which might be easier to reason about.
Cloud-y DLP tools don't know about EFS.
- inshadows 6y agoWrong. NFSv4 with Kerberos maps UIDs to Kerberos principals. Kerberos further allows you to apply (authenticated) encryption to transfers.
- philsnow 6y agoI stand corrected. I kind of knew that since I've been struggling with identity and access control on a home network, and have been trying to muddle through so far without setting up kerberos. I know there are people who have no trouble setting this stuff up, but I'm not one of them.
- geertj 6y ago(PM-T on the EFS team) The EFS/Lambda integration uses EFS Access Points, which allow you to enforce a specific POSIX identity and directory for NFS operations. You can also use IAM policies to require that specific IAM roles/users use a specific access point.
- philsnow 6y agoAh, didn't know that part, that's very good to learn. Thanks! edit: ah, EFS access points are general and you can mount them from EC2 instances ? MUCH better.