AWS.EFS reference

AccessPoint

Source: src/AWS/EFS/AccessPoint.ts

An Amazon EFS access point — an application-specific entry point into a file system that enforces a POSIX identity and a root directory.

Access points are how Lambda (and other serverless compute) mounts EFS: pass accessPoint.accessPointArn to a Lambda Function’s fileSystemConfigs. The POSIX user and root directory are immutable — changing them replaces the access point.

AccessPoint: Creating Access Points

import * as AWS from "alchemy/AWS";

const files = yield* AWS.EFS.FileSystem("Files");
const accessPoint = yield* AWS.EFS.AccessPoint("FilesAccess", {
  fileSystemId: files.fileSystemId,
  posixUser: { uid: 1000, gid: 1000 },
  rootDirectory: {
    path: "/app",
    creationInfo: { ownerUid: 1000, ownerGid: 1000, permissions: "750" },
  },
});

AccessPoint: Mounting into Lambda

const fn = yield* AWS.Lambda.Function("Api", {
  main: "./src/handler.ts",
  vpc: { subnetIds: [subnetId], securityGroupIds: [securityGroupId] },
  fileSystemConfigs: [
    { arn: accessPoint.accessPointArn, localMountPath: "/mnt/files" },
  ],
});

CreateAccessPoint

Source: src/AWS/EFS/CreateAccessPoint.ts

Runtime binding for the CreateAccessPoint operation (IAM actions elasticfilesystem:CreateAccessPoint on the file system ARN and elasticfilesystem:TagResource for tag-on-create).

Creates an access point into the bound FileSystem at runtime — the multi-tenant pattern where each tenant gets its own POSIX identity and root directory carved out of one file system. ClientToken makes the create idempotent; a repeated identical create surfaces the typed AccessPointAlreadyExists. For statically-known access points, prefer the AccessPoint resource. Provide the implementation with Effect.provide(AWS.EFS.CreateAccessPointHttp).

CreateAccessPoint: Managing Access Points at Runtime

const createAccessPoint = yield* AWS.EFS.CreateAccessPoint(files);

const accessPoint = yield* createAccessPoint({
  ClientToken: `tenant-${tenantId}`,
  PosixUser: { Uid: 1000, Gid: 1000 },
  RootDirectory: {
    Path: `/tenants/${tenantId}`,
    CreationInfo: { OwnerUid: 1000, OwnerGid: 1000, Permissions: "750" },
  },
});

DeleteAccessPoint

Source: src/AWS/EFS/DeleteAccessPoint.ts

Runtime binding for the DeleteAccessPoint operation (IAM action elasticfilesystem:DeleteAccessPoint).

Deletes an access point by ID — the teardown half of the runtime multi-tenant pattern built with CreateAccessPoint. The action authorizes on the access point’s own ARN, which for runtime-created access points is unknowable at deploy time, so the grant is on *. Deleting an already-deleted access point surfaces the typed AccessPointNotFound. Provide the implementation with Effect.provide(AWS.EFS.DeleteAccessPointHttp).

DeleteAccessPoint: Managing Access Points at Runtime

const deleteAccessPoint = yield* AWS.EFS.DeleteAccessPoint();

yield* deleteAccessPoint({ AccessPointId: accessPointId }).pipe(
  Effect.catchTag("AccessPointNotFound", () => Effect.void),
);

DescribeAccessPoints

Source: src/AWS/EFS/DescribeAccessPoints.ts

Runtime binding for the DescribeAccessPoints operation (IAM action elasticfilesystem:DescribeAccessPoints on the file system ARN).

Lists the bound FileSystem’s access points — e.g. to enumerate the per-tenant entry points created at runtime with CreateAccessPoint. Provide the implementation with Effect.provide(AWS.EFS.DescribeAccessPointsHttp).

DescribeAccessPoints: Managing Access Points at Runtime

const describeAccessPoints = yield* AWS.EFS.DescribeAccessPoints(files);

const { AccessPoints } = yield* describeAccessPoints();
for (const accessPoint of AccessPoints ?? []) {
  yield* Effect.log(`${accessPoint.Name}: ${accessPoint.AccessPointId}`);
}

DescribeBackupPolicy

Source: src/AWS/EFS/DescribeBackupPolicy.ts

Runtime binding for the DescribeBackupPolicy operation (IAM action elasticfilesystem:DescribeBackupPolicy on the file system ARN).

Reads whether AWS Backup automatic backups are enabled for the bound FileSystem. A file system that has never had a backup policy fails with the typed PolicyNotFound. Provide the implementation with Effect.provide(AWS.EFS.DescribeBackupPolicyHttp).

DescribeBackupPolicy: Backup Policy

const describeBackupPolicy = yield* AWS.EFS.DescribeBackupPolicy(files);

const status = yield* describeBackupPolicy().pipe(
  Effect.map((r) => r.BackupPolicy?.Status ?? "DISABLED"),
  Effect.catchTag("PolicyNotFound", () => Effect.succeed("DISABLED")),
);

DescribeFileSystem

Source: src/AWS/EFS/DescribeFileSystem.ts

Runtime binding for the DescribeFileSystems operation scoped to one file system (IAM action elasticfilesystem:DescribeFileSystems on the file system ARN).

Reads the bound FileSystem’s live description — lifecycle state, size in each storage class, throughput mode, mount target count — from inside a function runtime. Useful for storage dashboards and capacity monitors. Provide the implementation with Effect.provide(AWS.EFS.DescribeFileSystemHttp).

DescribeFileSystem: Inspecting File Systems

// init — bind the operation to the file system
const describeFileSystem = yield* AWS.EFS.DescribeFileSystem(files);

// runtime
const response = yield* describeFileSystem();
const fs = response.FileSystems?.[0];
yield* Effect.log(`${fs?.LifeCycleState}: ${fs?.SizeInBytes?.Value} bytes`);

DescribeLifecycleConfiguration

Source: src/AWS/EFS/DescribeLifecycleConfiguration.ts

Runtime binding for the DescribeLifecycleConfiguration operation (IAM action elasticfilesystem:DescribeLifecycleConfiguration on the file system ARN).

Reads the bound FileSystem’s lifecycle management rules — when files transition between Standard, Infrequent Access, and Archive storage. A file system without lifecycle management returns an empty array. Provide the implementation with Effect.provide(AWS.EFS.DescribeLifecycleConfigurationHttp).

DescribeLifecycleConfiguration: Lifecycle Management

const describeLifecycleConfiguration =
  yield* AWS.EFS.DescribeLifecycleConfiguration(files);

const { LifecyclePolicies } = yield* describeLifecycleConfiguration();

DescribeMountTargets

Source: src/AWS/EFS/DescribeMountTargets.ts

Runtime binding for the DescribeMountTargets operation (IAM action elasticfilesystem:DescribeMountTargets on the file system ARN).

Lists the bound FileSystem’s mount targets — the per-AZ NFS endpoints with their IP addresses and lifecycle states. Useful for health checks and for compute that needs to discover a mount target’s IP at runtime. Provide the implementation with Effect.provide(AWS.EFS.DescribeMountTargetsHttp).

DescribeMountTargets: Inspecting File Systems

const describeMountTargets = yield* AWS.EFS.DescribeMountTargets(files);

const { MountTargets } = yield* describeMountTargets();
for (const target of MountTargets ?? []) {
  yield* Effect.log(`${target.AvailabilityZoneName}: ${target.IpAddress}`);
}

DescribeReplicationConfigurations

Source: src/AWS/EFS/DescribeReplicationConfigurations.ts

Runtime binding for the DescribeReplicationConfigurations operation (IAM action elasticfilesystem:DescribeReplicationConfigurations on the file system ARN).

Reads the bound FileSystem’s replication configuration — destination file systems, replication status, and last-replicated timestamps. A file system with no replication fails with the typed ReplicationNotFound. Provide the implementation with Effect.provide(AWS.EFS.DescribeReplicationConfigurationsHttp).

DescribeReplicationConfigurations: Replication

const describeReplicationConfigurations =
  yield* AWS.EFS.DescribeReplicationConfigurations(files);

const status = yield* describeReplicationConfigurations().pipe(
  Effect.map((r) => r.Replications?.[0]?.Destinations[0]?.Status),
  Effect.catchTag("ReplicationNotFound", () => Effect.succeed(undefined)),
);

FileSystem

Source: src/AWS/EFS/FileSystem.ts

An Amazon EFS file system — serverless, elastic, shared POSIX storage.

The file system is created encrypted by default with a deterministic creation token derived from the app, stage, and logical ID, so retried creates are idempotent. Mount it into compute with MountTarget (per-subnet network endpoints) and AccessPoint (application-specific POSIX entry points — required for Lambda mounts).

FileSystem: Creating File Systems

Default file system (encrypted, general purpose)

import * as AWS from "alchemy/AWS";

const files = yield* AWS.EFS.FileSystem("Files");

Elastic throughput

const files = yield* AWS.EFS.FileSystem("Files", {
  throughputMode: "elastic",
});

FileSystem: Lifecycle Management

const files = yield* AWS.EFS.FileSystem("Files", {
  lifecyclePolicies: [
    { transitionToIA: "AFTER_30_DAYS" },
    { transitionToPrimaryStorageClass: "AFTER_1_ACCESS" },
  ],
});

FileSystem: Backup and Protection

Enable AWS Backup automatic backups

const files = yield* AWS.EFS.FileSystem("Files", {
  backup: true,
});

Allow the file system to be a replication destination

const files = yield* AWS.EFS.FileSystem("Files", {
  replicationOverwriteProtection: "DISABLED",
});

FileSystem: File System Policy

const files = yield* AWS.EFS.FileSystem("Files", {
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Sid: "DenyUnencryptedTransport",
        Effect: "Deny",
        Principal: { AWS: "*" },
        Action: ["elasticfilesystem:ClientMount"],
        Condition: { Bool: { "aws:SecureTransport": "false" } },
      },
    ],
  },
});

FileSystem: Mounting into Lambda

Lambda mounts EFS through an access point; the function must be attached to a VPC that can reach a mount target.

File system + mount target + access point + Lambda

const files = yield* AWS.EFS.FileSystem("Files");
const target = yield* AWS.EFS.MountTarget("FilesTarget", {
  fileSystemId: files.fileSystemId,
  subnetId,
});
const accessPoint = yield* AWS.EFS.AccessPoint("FilesAccess", {
  fileSystemId: files.fileSystemId,
  posixUser: { uid: 1000, gid: 1000 },
  rootDirectory: {
    path: "/lambda",
    creationInfo: { ownerUid: 1000, ownerGid: 1000, permissions: "750" },
  },
});
const fn = yield* AWS.Lambda.Function("Api", {
  main: "./src/handler.ts",
  vpc: { subnetIds: [subnetId], securityGroupIds: [securityGroupId] },
  fileSystemConfigs: [
    // pass the AccessPoint resource itself (or its ARN)
    { accessPoint, localMountPath: "/mnt/files" },
  ],
  // depend on the mount target so the function is created only after
  // the network endpoint is available
  env: { EFS_MOUNT_TARGET: target.mountTargetId },
});

Host-agnostic mount binding (Lambda or ECS)

EFS.mount wires the mount config + least-privilege IAM through the host’s binding channel — the same code works inside a Lambda Function or an ECS Task body (provide AWS.EFS.MountLive on the host Effect).

export default class Api extends AWS.Lambda.Function<Api>()(
  "Api",
  { main: import.meta.url, vpc: { subnetIds, securityGroupIds } },
  Effect.gen(function* () {
    const files = yield* AWS.EFS.mount(accessPoint, { path: "/mnt/files" });
    return Effect.fn(function* (event: unknown) {
      // read/write under files.path at runtime
      return { mountedAt: files.path };
    });
  }).pipe(Effect.provide(AWS.EFS.MountLive)),
) {}

Mount

Source: src/AWS/EFS/Mount.ts

Host-agnostic EFS mount binding.

yield* EFS.mount(accessPoint, { path: "/mnt/data" }) inside a compute body wires the file system into whatever host the code deploys to:

• Lambda — injects a FileSystemConfigs entry (the access point ARN + local mount path) through the Function’s binding channel and grants the execution role elasticfilesystem:ClientMount/ClientWrite scoped to the access point. Lambda requires an AWS.EFS.AccessPoint (not a bare file system) and a /mnt/… path, and the Function must have vpc set to subnets that can reach an EFS mount target.
• ECS Task — injects a task-level EFS volume (transit encryption on, IAM auth on, access-point scoped when one is given) plus a container mount point, and grants the task role the matching client actions.

Provide the EFS.MountLive layer on the Function/Task Effect to satisfy the binding. Mount targets for the file system’s VPC/subnets must already exist (AWS.EFS.MountTarget).

MountTarget

Source: src/AWS/EFS/MountTarget.ts

An Amazon EFS mount target — the per-subnet network endpoint (an ENI serving NFS on TCP 2049) that compute in a VPC uses to reach a file system.

Create one mount target per Availability Zone you run compute in. The reconciler waits for the mount target to reach the available state (typically 1–2 minutes), so downstream resources that depend on its attributes deploy only once the endpoint is usable. Deletion likewise waits until the mount target is fully gone, because its ENI must be released before the subnet, security groups, or file system can be deleted.

MountTarget: Creating Mount Targets

Mount target in a subnet

import * as AWS from "alchemy/AWS";

const files = yield* AWS.EFS.FileSystem("Files");
const target = yield* AWS.EFS.MountTarget("FilesTarget", {
  fileSystemId: files.fileSystemId,
  subnetId,
});

Mount target with explicit security groups

const target = yield* AWS.EFS.MountTarget("FilesTarget", {
  fileSystemId: files.fileSystemId,
  subnetId,
  securityGroups: [nfsSecurityGroupId],
});

PutBackupPolicy

Source: src/AWS/EFS/PutBackupPolicy.ts

Runtime binding for the PutBackupPolicy operation (IAM action elasticfilesystem:PutBackupPolicy on the file system ARN).

Starts or stops AWS Backup automatic backups for the bound FileSystem at runtime. For declarative control, prefer the FileSystem resource’s backup prop — this binding is for operational tooling that toggles backups on demand. Provide the implementation with Effect.provide(AWS.EFS.PutBackupPolicyHttp).

PutBackupPolicy: Backup Policy

const putBackupPolicy = yield* AWS.EFS.PutBackupPolicy(files);

const { BackupPolicy } = yield* putBackupPolicy({
  BackupPolicy: { Status: "ENABLED" },
});

PutLifecycleConfiguration

Source: src/AWS/EFS/PutLifecycleConfiguration.ts

Runtime binding for the PutLifecycleConfiguration operation (IAM action elasticfilesystem:PutLifecycleConfiguration on the file system ARN).

Replaces the bound FileSystem’s lifecycle management rules at runtime; an empty LifecyclePolicies array disables lifecycle management. For declarative control, prefer the FileSystem resource’s lifecyclePolicies prop — this binding is for operational tooling that tunes storage tiering on demand. Provide the implementation with Effect.provide(AWS.EFS.PutLifecycleConfigurationHttp).

PutLifecycleConfiguration: Lifecycle Management

const putLifecycleConfiguration =
  yield* AWS.EFS.PutLifecycleConfiguration(files);

yield* putLifecycleConfiguration({
  LifecyclePolicies: [{ TransitionToIA: "AFTER_30_DAYS" }],
});