troubleshooting-efs

Diagnose and resolve Amazon EFS mount failures, permission errors, and performance issues.

Updated Jul 1, 2026
One-click install
npx skills add https://github.com/sakicodes/BuildFestHackathon26 --skill troubleshooting-efs-sakicodes
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: troubleshooting-efs
Source: https://github.com/sakicodes/BuildFestHackathon26/tree/main/.agents/skills/troubleshooting-efs
Command: npx skills add https://github.com/sakicodes/BuildFestHackathon26 --skill troubleshooting-efs-sakicodes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Amazon EFS file systems can fail to mount, deny access, or perform slowly for many different reasons, and finding the root cause requires checking security groups, IAM policies, NFS clients, KMS keys, and VPC DNS settings. This Skill provides a structured diagnostic workflow that classifies symptoms and walks through the exact AWS CLI commands needed to identify and fix each category of EFS issue. ## Core Features & Use Cases - Symptom Classification: Maps common error messages like "wrong fs type", "access denied by server", and connection timeouts to six distinct root-cause categories. - Guided Remediation: Provides step-by-step AWS CLI commands for fixing security group rules, IAM file system policies, burst credit exhaustion, KMS key issues, and VPC DNS settings. - Use Case: An EC2 instance hangs for two minutes and then times out when mounting an EFS file system. The Skill identifies this as a network/security group issue, checks that the mount target's security group allows inbound TCP 2049 from the instance's security group, and applies the missing ingress rule. ## Quick Start Diagnose why my EFS file system fs-12345678 fails to mount on my EC2 instance with a connection timeout error.

Frequently Asked Questions about troubleshooting-efs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix an EFS mount that times out?

An EFS mount timeout is almost always a security group issue. Verify the mount target's security group allows inbound TCP port 2049 from the compute instance's security group, and confirm the instance's security group allows outbound TCP 2049 to the mount target.

Why does EFS mount fail with access denied by server?

Access denied with the -o iam option means the identity-based IAM policy lacks elasticfilesystem:ClientMount or the file system resource policy denies access. Without the iam option, check POSIX file ownership with ls -la or use EFS access points to enforce consistent UID/GID.

How do I check EFS burst credit balance?

Query the BurstCreditBalance metric in CloudWatch for the file system over the past 24 hours using aws cloudwatch get-metric-statistics. If credits are near zero in Bursting throughput mode, switch to Elastic throughput with aws efs update-file-system.

Does EFS enforce IAM authorization by default?

No, IAM authorization is only enforced when a file system policy exists that requires it. Without a file system policy, any client in the VPC with port 2049 access can mount, even when using the -o iam mount option.

Why does EFS auto-mount fail after a reboot?

Auto-mount fails when the /etc/fstab entry is missing the _netdev option, which tells the system to wait for network availability before mounting. Add _netdev to the fstab entry so the mount occurs after networking is up.

How do I fix EFS DNS name resolution failures?

DNS resolution failures occur when VPC DNS settings are disabled. Verify both enableDnsHostnames and enableDnsSupport are true using aws ec2 describe-vpc-attribute, and enable them with aws ec2 modify-vpc-attribute if needed.