2020/01/13 - Amazon Elastic File System - 9 new 2 updated api methods
Changes This release adds support for managing EFS file system policies and EFS Access Points.
Deletes the FileSystemPolicy for the specified file system. The default FileSystemPolicy goes into effect once the existing policy is deleted. For more information about the default file system policy, see Using Resource-based Policies with EFS.
This operation requires permissions for the elasticfilesystem:DeleteFileSystemPolicy action.
See also: AWS API Documentation
Request Syntax
client.delete_file_system_policy(
FileSystemId='string'
)
string
[REQUIRED]
Specifies the EFS file system for which to delete the FileSystemPolicy .
None
Creates an EFS access point. An access point is an application-specific view into an EFS file system that applies an operating system user and group, and a file system path, to any file system request made through the access point. The operating system user and group override any identity information provided by the NFS client. The file system path is exposed as the access point's root directory. Applications using the access point can only access data in its own directory and below. To learn more, see Mounting a File System Using EFS Access Points.
This operation requires permissions for the elasticfilesystem:CreateAccessPoint action.
See also: AWS API Documentation
Request Syntax
client.create_access_point(
ClientToken='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
],
FileSystemId='string',
PosixUser={
'Uid': 123,
'Gid': 123,
'SecondaryGids': [
123,
]
},
RootDirectory={
'Path': 'string',
'CreationInfo': {
'OwnerUid': 123,
'OwnerGid': 123,
'Permissions': 'string'
}
}
)
string
[REQUIRED]
A string of up to 64 ASCII characters that Amazon EFS uses to ensure idempotent creation.
This field is autopopulated if not provided.
list
Creates tags associated with the access point. Each tag is a key-value pair.
(dict) --
A tag is a key-value pair. Allowed characters are letters, white space, and numbers that can be represented in UTF-8, and the following characters: + - = . _ : /
Key (string) -- [REQUIRED]
The tag key (String). The key can't start with aws: .
Value (string) -- [REQUIRED]
The value of the tag key.
string
[REQUIRED]
The ID of the EFS file system that the access point provides access to.
dict
The operating system user and group applied to all file system requests made using the access point.
Uid (integer) -- [REQUIRED]
The POSIX user ID used for all file system operations using this access point.
Gid (integer) -- [REQUIRED]
The POSIX group ID used for all file system operations using this access point.
SecondaryGids (list) --
Secondary POSIX group IDs used for all file system operations using this access point.
(integer) --
dict
Specifies the directory on the Amazon EFS file system that the access point exposes as the root directory of your file system to NFS clients using the access point. The clients using the access point can only access the root directory and below. If the RootDirectory > Path specified does not exist, EFS creates it and applies the CreationInfo settings when a client connects to an access point. When specifying a RootDirectory , you need to provide the Path , and the CreationInfo is optional.
Path (string) --
Specifies the path on the EFS file system to expose as the root directory to NFS clients using the access point to access the EFS file system. A path can have up to four subdirectories. If the specified path does not exist, you are required to provide the CreationInfo .
CreationInfo (dict) --
(Optional) Specifies the POSIX IDs and permissions to apply to the access point's RootDirectory . If the RootDirectory > Path specified does not exist, EFS creates the root directory using the CreationInfo settings when a client connects to an access point. When specifying the CreationInfo , you must provide values for all properties.
Warning
If you do not provide CreationInfo and the specified RootDirectory > Path does not exist, attempts to mount the file system using the access point will fail.
OwnerUid (integer) -- [REQUIRED]
Specifies the POSIX user ID to apply to the RootDirectory . Accepts values from 0 to 2^32 (4294967295).
OwnerGid (integer) -- [REQUIRED]
Specifies the POSIX group ID to apply to the RootDirectory . Accepts values from 0 to 2^32 (4294967295).
Permissions (string) -- [REQUIRED]
Specifies the POSIX permissions to apply to the RootDirectory , in the format of an octal number representing the file's mode bits.
dict
Response Syntax
{
'ClientToken': 'string',
'Name': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'AccessPointId': 'string',
'AccessPointArn': 'string',
'FileSystemId': 'string',
'PosixUser': {
'Uid': 123,
'Gid': 123,
'SecondaryGids': [
123,
]
},
'RootDirectory': {
'Path': 'string',
'CreationInfo': {
'OwnerUid': 123,
'OwnerGid': 123,
'Permissions': 'string'
}
},
'OwnerId': 'string',
'LifeCycleState': 'creating'|'available'|'updating'|'deleting'|'deleted'
}
Response Structure
(dict) --
Provides a description of an EFS file system access point.
ClientToken (string) --
The opaque string specified in the request to ensure idempotent creation.
Name (string) --
The name of the access point. This is the value of the Name tag.
Tags (list) --
The tags associated with the access point, presented as an array of Tag objects.
(dict) --
A tag is a key-value pair. Allowed characters are letters, white space, and numbers that can be represented in UTF-8, and the following characters: + - = . _ : /
Key (string) --
The tag key (String). The key can't start with aws: .
Value (string) --
The value of the tag key.
AccessPointId (string) --
The ID of the access point, assigned by Amazon EFS.
AccessPointArn (string) --
The unique Amazon Resource Name (ARN) associated with the access point.
FileSystemId (string) --
The ID of the EFS file system that the access point applies to.
PosixUser (dict) --
The full POSIX identity, including the user ID, group ID, and secondary group IDs on the access point that is used for all file operations by NFS clients using the access point.
Uid (integer) --
The POSIX user ID used for all file system operations using this access point.
Gid (integer) --
The POSIX group ID used for all file system operations using this access point.
SecondaryGids (list) --
Secondary POSIX group IDs used for all file system operations using this access point.
(integer) --
RootDirectory (dict) --
The directory on the Amazon EFS file system that the access point exposes as the root directory to NFS clients using the access point.
Path (string) --
Specifies the path on the EFS file system to expose as the root directory to NFS clients using the access point to access the EFS file system. A path can have up to four subdirectories. If the specified path does not exist, you are required to provide the CreationInfo .
CreationInfo (dict) --
(Optional) Specifies the POSIX IDs and permissions to apply to the access point's RootDirectory . If the RootDirectory > Path specified does not exist, EFS creates the root directory using the CreationInfo settings when a client connects to an access point. When specifying the CreationInfo , you must provide values for all properties.
Warning
If you do not provide CreationInfo and the specified RootDirectory > Path does not exist, attempts to mount the file system using the access point will fail.
OwnerUid (integer) --
Specifies the POSIX user ID to apply to the RootDirectory . Accepts values from 0 to 2^32 (4294967295).
OwnerGid (integer) --
Specifies the POSIX group ID to apply to the RootDirectory . Accepts values from 0 to 2^32 (4294967295).
Permissions (string) --
Specifies the POSIX permissions to apply to the RootDirectory , in the format of an octal number representing the file's mode bits.
OwnerId (string) --
Identified the AWS account that owns the access point resource.
LifeCycleState (string) --
Identifies the lifecycle phase of the access point.
Deletes the specified access point. After deletion is complete, new clients can no longer connect to the access points. Clients connected to the access point at the time of deletion will continue to function until they terminate their connection.
This operation requires permissions for the elasticfilesystem:DeleteAccessPoint action.
See also: AWS API Documentation
Request Syntax
client.delete_access_point(
AccessPointId='string'
)
string
[REQUIRED]
The ID of the access point that you want to delete.
None
Returns the FileSystemPolicy for the specified EFS file system.
This operation requires permissions for the elasticfilesystem:DescribeFileSystemPolicy action.
See also: AWS API Documentation
Request Syntax
client.describe_file_system_policy(
FileSystemId='string'
)
string
[REQUIRED]
Specifies which EFS file system to retrieve the FileSystemPolicy for.
dict
Response Syntax
{
'FileSystemId': 'string',
'Policy': 'string'
}
Response Structure
(dict) --
FileSystemId (string) --
Specifies the EFS file system to which the FileSystemPolicy applies.
Policy (string) --
The JSON formatted FileSystemPolicy for the EFS file system.
Removes tags from an EFS resource. You can remove tags from EFS file systems and access points using this API operation.
This operation requires permissions for the elasticfilesystem:UntagResource action.
See also: AWS API Documentation
Request Syntax
client.untag_resource(
ResourceId='string',
TagKeys=[
'string',
]
)
string
[REQUIRED]
Specifies the EFS resource that you want to remove tags from.
list
The keys of the key:value tag pairs that you want to remove from the specified EFS resource.
(string) --
None
Applies an Amazon EFS FileSystemPolicy to an Amazon EFS file system. A file system policy is an IAM resource-based policy and can contain multiple policy statements. A file system always has exactly one file system policy, which can be the default policy or an explicit policy set or updated using this API operation. When an explicit policy is set, it overrides the default policy. For more information about the default file system policy, see Using Resource-based Policies with EFS.
This operation requires permissions for the elasticfilesystem:PutFileSystemPolicy action.
See also: AWS API Documentation
Request Syntax
client.put_file_system_policy(
FileSystemId='string',
Policy='string',
BypassPolicyLockoutSafetyCheck=True|False
)
string
[REQUIRED]
The ID of the EFS file system that you want to create or update the FileSystemPolicy for.
string
[REQUIRED]
The FileSystemPolicy that you're creating. Accepts a JSON formatted policy definition. To find out more about the elements that make up a file system policy, see EFS Resource-based Policies.
boolean
(Optional) A flag to indicate whether to bypass the FileSystemPolicy lockout safety check. The policy lockout safety check determines whether the policy in the request will prevent the principal making the request will be locked out from making future PutFileSystemPolicy requests on the file system. Set BypassPolicyLockoutSafetyCheck to True only when you intend to prevent the principal that is making the request from making a subsequent PutFileSystemPolicy request on the file system. The default value is False.
dict
Response Syntax
{
'FileSystemId': 'string',
'Policy': 'string'
}
Response Structure
(dict) --
FileSystemId (string) --
Specifies the EFS file system to which the FileSystemPolicy applies.
Policy (string) --
The JSON formatted FileSystemPolicy for the EFS file system.
Creates a tag for an EFS resource. You can create tags for EFS file systems and access points using this API operation.
This operation requires permissions for the elasticfilesystem:TagResource action.
See also: AWS API Documentation
Request Syntax
client.tag_resource(
ResourceId='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
The ID specifying the EFS resource that you want to create a tag for.
list
[REQUIRED]
(dict) --
A tag is a key-value pair. Allowed characters are letters, white space, and numbers that can be represented in UTF-8, and the following characters: + - = . _ : /
Key (string) -- [REQUIRED]
The tag key (String). The key can't start with aws: .
Value (string) -- [REQUIRED]
The value of the tag key.
None
Returns the description of a specific Amazon EFS access point if the AccessPointId is provided. If you provide an EFS FileSystemId , it returns descriptions of all access points for that file system. You can provide either an AccessPointId or a FileSystemId in the request, but not both.
This operation requires permissions for the elasticfilesystem:DescribeAccessPoints action.
See also: AWS API Documentation
Request Syntax
client.describe_access_points(
MaxResults=123,
NextToken='string',
AccessPointId='string',
FileSystemId='string'
)
integer
(Optional) When retrieving all access points for a file system, you can optionally specify the MaxItems parameter to limit the number of objects returned in a response. The default value is 100.
string
NextToken is present if the response is paginated. You can use NextMarker in the subsequent request to fetch the next page of access point descriptions.
string
(Optional) Specifies an EFS access point to describe in the response; mutually exclusive with FileSystemId .
string
(Optional) If you provide a FileSystemId , EFS returns all access points for that file system; mutually exclusive with AccessPointId .
dict
Response Syntax
{
'AccessPoints': [
{
'ClientToken': 'string',
'Name': 'string',
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'AccessPointId': 'string',
'AccessPointArn': 'string',
'FileSystemId': 'string',
'PosixUser': {
'Uid': 123,
'Gid': 123,
'SecondaryGids': [
123,
]
},
'RootDirectory': {
'Path': 'string',
'CreationInfo': {
'OwnerUid': 123,
'OwnerGid': 123,
'Permissions': 'string'
}
},
'OwnerId': 'string',
'LifeCycleState': 'creating'|'available'|'updating'|'deleting'|'deleted'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
AccessPoints (list) --
An array of access point descriptions.
(dict) --
Provides a description of an EFS file system access point.
ClientToken (string) --
The opaque string specified in the request to ensure idempotent creation.
Name (string) --
The name of the access point. This is the value of the Name tag.
Tags (list) --
The tags associated with the access point, presented as an array of Tag objects.
(dict) --
A tag is a key-value pair. Allowed characters are letters, white space, and numbers that can be represented in UTF-8, and the following characters: + - = . _ : /
Key (string) --
The tag key (String). The key can't start with aws: .
Value (string) --
The value of the tag key.
AccessPointId (string) --
The ID of the access point, assigned by Amazon EFS.
AccessPointArn (string) --
The unique Amazon Resource Name (ARN) associated with the access point.
FileSystemId (string) --
The ID of the EFS file system that the access point applies to.
PosixUser (dict) --
The full POSIX identity, including the user ID, group ID, and secondary group IDs on the access point that is used for all file operations by NFS clients using the access point.
Uid (integer) --
The POSIX user ID used for all file system operations using this access point.
Gid (integer) --
The POSIX group ID used for all file system operations using this access point.
SecondaryGids (list) --
Secondary POSIX group IDs used for all file system operations using this access point.
(integer) --
RootDirectory (dict) --
The directory on the Amazon EFS file system that the access point exposes as the root directory to NFS clients using the access point.
Path (string) --
Specifies the path on the EFS file system to expose as the root directory to NFS clients using the access point to access the EFS file system. A path can have up to four subdirectories. If the specified path does not exist, you are required to provide the CreationInfo .
CreationInfo (dict) --
(Optional) Specifies the POSIX IDs and permissions to apply to the access point's RootDirectory . If the RootDirectory > Path specified does not exist, EFS creates the root directory using the CreationInfo settings when a client connects to an access point. When specifying the CreationInfo , you must provide values for all properties.
Warning
If you do not provide CreationInfo and the specified RootDirectory > Path does not exist, attempts to mount the file system using the access point will fail.
OwnerUid (integer) --
Specifies the POSIX user ID to apply to the RootDirectory . Accepts values from 0 to 2^32 (4294967295).
OwnerGid (integer) --
Specifies the POSIX group ID to apply to the RootDirectory . Accepts values from 0 to 2^32 (4294967295).
Permissions (string) --
Specifies the POSIX permissions to apply to the RootDirectory , in the format of an octal number representing the file's mode bits.
OwnerId (string) --
Identified the AWS account that owns the access point resource.
LifeCycleState (string) --
Identifies the lifecycle phase of the access point.
NextToken (string) --
Present if there are more access points than returned in the response. You can use the NextMarker in the subsequent request to fetch the additional descriptions.
Lists all tags for a top-level EFS resource. You must provide the ID of the resource that you want to retrieve the tags for.
This operation requires permissions for the elasticfilesystem:DescribeAccessPoints action.
See also: AWS API Documentation
Request Syntax
client.list_tags_for_resource(
ResourceId='string',
MaxResults=123,
NextToken='string'
)
string
[REQUIRED]
Specifies the EFS resource you want to retrieve tags for. You can retrieve tags for EFS file systems and access points using this API endpoint.
integer
(Optional) Specifies the maximum number of tag objects to return in the response. The default value is 100.
string
You can use NextToken in a subsequent request to fetch the next page of access point descriptions if the response payload was paginated.
dict
Response Syntax
{
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
Tags (list) --
An array of the tags for the specified EFS resource.
(dict) --
A tag is a key-value pair. Allowed characters are letters, white space, and numbers that can be represented in UTF-8, and the following characters: + - = . _ : /
Key (string) --
The tag key (String). The key can't start with aws: .
Value (string) --
The value of the tag key.
NextToken (string) --
NextToken is present if the response payload is paginated. You can use NextToken in a subsequent request to fetch the next page of access point descriptions.
{'AvailabilityZoneId': 'string', 'AvailabilityZoneName': 'string'}
Creates a mount target for a file system. You can then mount the file system on EC2 instances by using the mount target.
You can create one mount target in each Availability Zone in your VPC. All EC2 instances in a VPC within a given Availability Zone share a single mount target for a given file system. If you have multiple subnets in an Availability Zone, you create a mount target in one of the subnets. EC2 instances do not need to be in the same subnet as the mount target in order to access their file system. For more information, see Amazon EFS: How it Works.
In the request, you also specify a file system ID for which you are creating the mount target and the file system's lifecycle state must be available . For more information, see DescribeFileSystems.
In the request, you also provide a subnet ID, which determines the following:
VPC in which Amazon EFS creates the mount target
Availability Zone in which Amazon EFS creates the mount target
IP address range from which Amazon EFS selects the IP address of the mount target (if you don't specify an IP address in the request)
After creating the mount target, Amazon EFS returns a response that includes, a MountTargetId and an IpAddress . You use this IP address when mounting the file system in an EC2 instance. You can also use the mount target's DNS name when mounting the file system. The EC2 instance on which you mount the file system by using the mount target can resolve the mount target's DNS name to its IP address. For more information, see How it Works: Implementation Overview.
Note that you can create mount targets for a file system in only one VPC, and there can be only one mount target per Availability Zone. That is, if the file system already has one or more mount targets created for it, the subnet specified in the request to add another mount target must meet the following requirements:
Must belong to the same VPC as the subnets of the existing mount targets
Must not be in the same Availability Zone as any of the subnets of the existing mount targets
If the request satisfies the requirements, Amazon EFS does the following:
Creates a new mount target in the specified subnet.
Also creates a new network interface in the subnet as follows:
If the request provides an IpAddress , Amazon EFS assigns that IP address to the network interface. Otherwise, Amazon EFS assigns a free address in the subnet (in the same way that the Amazon EC2 CreateNetworkInterface call does when a request does not specify a primary private IP address).
If the request provides SecurityGroups , this network interface is associated with those security groups. Otherwise, it belongs to the default security group for the subnet's VPC.
Assigns the description Mount target fsmt-idfor file system fs-id where fsmt-id is the mount target ID, and fs-id is the FileSystemId .
Sets the requesterManaged property of the network interface to true , and the requesterId value to EFS .
Each Amazon EFS mount target has one corresponding requester-managed EC2 network interface. After the network interface is created, Amazon EFS sets the NetworkInterfaceId field in the mount target's description to the network interface ID, and the IpAddress field to its address. If network interface creation fails, the entire CreateMountTarget operation fails.
Note
The CreateMountTarget call returns only after creating the network interface, but while the mount target state is still creating , you can check the mount target creation status by calling the DescribeMountTargets operation, which among other things returns the mount target state.
We recommend that you create a mount target in each of the Availability Zones. There are cost considerations for using a file system in an Availability Zone through a mount target created in another Availability Zone. For more information, see Amazon EFS. In addition, by always using a mount target local to the instance's Availability Zone, you eliminate a partial failure scenario. If the Availability Zone in which your mount target is created goes down, then you can't access your file system through that mount target.
This operation requires permissions for the following action on the file system:
elasticfilesystem:CreateMountTarget
This operation also requires permissions for the following Amazon EC2 actions:
ec2:DescribeSubnets
ec2:DescribeNetworkInterfaces
ec2:CreateNetworkInterface
See also: AWS API Documentation
Request Syntax
client.create_mount_target(
FileSystemId='string',
SubnetId='string',
IpAddress='string',
SecurityGroups=[
'string',
]
)
string
[REQUIRED]
The ID of the file system for which to create the mount target.
string
[REQUIRED]
The ID of the subnet to add the mount target in.
string
Valid IPv4 address within the address range of the specified subnet.
list
Up to five VPC security group IDs, of the form sg-xxxxxxxx . These must be for the same VPC as subnet specified.
(string) --
dict
Response Syntax
{
'OwnerId': 'string',
'MountTargetId': 'string',
'FileSystemId': 'string',
'SubnetId': 'string',
'LifeCycleState': 'creating'|'available'|'updating'|'deleting'|'deleted',
'IpAddress': 'string',
'NetworkInterfaceId': 'string',
'AvailabilityZoneId': 'string',
'AvailabilityZoneName': 'string'
}
Response Structure
(dict) --
Provides a description of a mount target.
OwnerId (string) --
AWS account ID that owns the resource.
MountTargetId (string) --
System-assigned mount target ID.
FileSystemId (string) --
The ID of the file system for which the mount target is intended.
SubnetId (string) --
The ID of the mount target's subnet.
LifeCycleState (string) --
Lifecycle state of the mount target.
IpAddress (string) --
Address at which the file system can be mounted by using the mount target.
NetworkInterfaceId (string) --
The ID of the network interface that Amazon EFS created when it created the mount target.
AvailabilityZoneId (string) --
The unique and consistent identifier of the Availability Zone (AZ) that the mount target resides in. For example, use1-az1 is an AZ ID for the us-east-1 Region and it has the same location in every AWS account.
AvailabilityZoneName (string) --
The name of the Availability Zone (AZ) that the mount target resides in. AZs are independently mapped to names for each AWS account. For example, the Availability Zone us-east-1a for your AWS account might not be the same location as us-east-1a for another AWS account.
{'AccessPointId': 'string'}
Response {'MountTargets': {'AvailabilityZoneId': 'string',
'AvailabilityZoneName': 'string'}}
Returns the descriptions of all the current mount targets, or a specific mount target, for a file system. When requesting all of the current mount targets, the order of mount targets returned in the response is unspecified.
This operation requires permissions for the elasticfilesystem:DescribeMountTargets action, on either the file system ID that you specify in FileSystemId , or on the file system of the mount target that you specify in MountTargetId .
See also: AWS API Documentation
Request Syntax
client.describe_mount_targets(
MaxItems=123,
Marker='string',
FileSystemId='string',
MountTargetId='string',
AccessPointId='string'
)
integer
(Optional) Maximum number of mount targets to return in the response. Currently, this number is automatically set to 10, and other values are ignored. The response is paginated at 100 per page if you have more than 100 mount targets.
string
(Optional) Opaque pagination token returned from a previous DescribeMountTargets operation (String). If present, it specifies to continue the list from where the previous returning call left off.
string
(Optional) ID of the file system whose mount targets you want to list (String). It must be included in your request if an AccessPointId or MountTargetId is not included. Accepts either a file system ID or ARN as input.
string
(Optional) ID of the mount target that you want to have described (String). It must be included in your request if FileSystemId is not included. Accepts either a mount target ID or ARN as input.
string
(Optional) The ID of the access point whose mount targets that you want to list. It must be included in your request if a FileSystemId or MountTargetId is not included in your request. Accepts either an access point ID or ARN as input.
dict
Response Syntax
{
'Marker': 'string',
'MountTargets': [
{
'OwnerId': 'string',
'MountTargetId': 'string',
'FileSystemId': 'string',
'SubnetId': 'string',
'LifeCycleState': 'creating'|'available'|'updating'|'deleting'|'deleted',
'IpAddress': 'string',
'NetworkInterfaceId': 'string',
'AvailabilityZoneId': 'string',
'AvailabilityZoneName': 'string'
},
],
'NextMarker': 'string'
}
Response Structure
(dict) --
Marker (string) --
If the request included the Marker , the response returns that value in this field.
MountTargets (list) --
Returns the file system's mount targets as an array of MountTargetDescription objects.
(dict) --
Provides a description of a mount target.
OwnerId (string) --
AWS account ID that owns the resource.
MountTargetId (string) --
System-assigned mount target ID.
FileSystemId (string) --
The ID of the file system for which the mount target is intended.
SubnetId (string) --
The ID of the mount target's subnet.
LifeCycleState (string) --
Lifecycle state of the mount target.
IpAddress (string) --
Address at which the file system can be mounted by using the mount target.
NetworkInterfaceId (string) --
The ID of the network interface that Amazon EFS created when it created the mount target.
AvailabilityZoneId (string) --
The unique and consistent identifier of the Availability Zone (AZ) that the mount target resides in. For example, use1-az1 is an AZ ID for the us-east-1 Region and it has the same location in every AWS account.
AvailabilityZoneName (string) --
The name of the Availability Zone (AZ) that the mount target resides in. AZs are independently mapped to names for each AWS account. For example, the Availability Zone us-east-1a for your AWS account might not be the same location as us-east-1a for another AWS account.
NextMarker (string) --
If a value is present, there are more mount targets to return. In a subsequent request, you can provide Marker in your request with this value to retrieve the next set of mount targets.