Selena Say Yes
What EFS actually deploys when you're not paying attention
Selena said yes to EFS on a Tuesday. By Thursday, Bart had opinions.
It started reasonably enough. The team needed shared file storage - something multiple EC2 instances could read and write simultaneously. Selena had done the research. Amazon EFS. Fully managed, elastic, scales automatically. No capacity planning. No partitions. Just mount it and go.
“It’s perfect,” she said. “We deploy it, we’re done.” JJ liked the sound of done.
Bart did not like anything about this conversation.
EFS doesn’t deploy alone
It brings dependencies. And each dependency brings a decision - whether you make it consciously or not.
Dependency one: AWS Backup
EFS integrates with AWS Backup, and depending on your account and organizational settings, a default backup plan may activate automatically with daily backups and 35-day retention. That sounds responsible. It also means every gigabyte of EFS data generates a corresponding gigabyte of backup storage, billed separately, and retained for over a month by default.
If you already have a backup strategy, you may now be running two simultaneously. If you don’t, you have one you never configured and almost certainly never priced out.
Neither situation is a great outcome. The correct move is to check your backup configuration explicitly before deployment and make a deliberate choice - not discover the choices that were made for you when the bill arrives.
Dependency two: Encryption
EFS encrypts data at rest by default. That’s the right behavior and worth saying clearly. But the default key is the AWS-managed key for EFS - `aws/elasticfilesystem` - not a customer-managed key.
The practical difference is meaningful. With the default AWS-managed key you get encryption without control. You cannot write a key policy restricting who can use it. You cannot set a custom rotation schedule. Your CloudTrail audit trail shows all KMS activity but tells you considerably less than it would with a customer-managed key (CMK).
A customer-managed KMS key costs $1 per month plus $0.03 per 10,000 API calls. For that you get a key policy, key rotation control you define, and an audit trail that holds up in a compliance conversation. For most workloads it’s the correct choice. It just requires making the choice explicitly rather than accepting the pre-selected default.
Selena had accepted what the EFS install pre-selected. Bart noticed.
Dependency three: Mount targets
EFS needs mount targets to be accessible within your VPC. When Selena accepted the EFS defaults, mount targets were created automatically in every available subnet including the public ones.
Bart found the public subnet mount targets on Friday morning.
“Why,” he said, to no one in particular, “is our EFS file system reachable from the internet?”
Technically it wasn’t. Well, not directly. EFS uses NFS protocol on port 2049. The assigned security group controls inbound access. At this moment, the security group was configured correctly.
Bart was not comforted by this.
NFS was not designed with public internet exposure in mind. A mount target in a public subnet doesn’t create an immediate breach, but it shortens the distance between a misconfigured security group rule and a serious problem. Security groups get changed. Temporary rules get forgotten. People make mistakes.
Mount targets belong in private subnets. The security group is not a sufficient reason to place them anywhere else. Defense in depth means you don’t rely on a single control being correct forever.
One more thing: the storage class
EFS Standard is the default storage class. It’s also the most expensive option; roughly three times the per-GB cost of EFS Infrequent Access. Once enabled, EFS Intelligent-Tiering moves cold data to IA automatically after 30 days, with no performance impact on subsequent access.
If half your stored data is infrequently accessed, Intelligent-Tiering roughly halves that portion of your storage costs. Most deployments miss enabling it because EFS Standard was already selected, and nothing in the console flags the price difference.
The bill JJ didn’t expect
JJ asked what all of this was going to cost. Nobody had run the numbers before deployment.
Here’s what the numbers look like in practice. EFS Standard storage is billed per GB-month. Backup storage is also billed per GB-month and held for 35 days. The CMK is a dollar a month plus any API call charges. None of these line items is catastrophic individually. Together, on a file system with meaningful data volume and active API traffic, they produce a bill that surprises people - not because EFS is an expensive service, but because four quiet defaults each added something the original estimate didn’t include.
JJ wrote *double storage cost? on a Post-it note and stuck it to his monitor.
He added a second note: whose key is this?
And then a third note: what’s a public subnet again?
What Bart fixed over the weekend
Mount targets were moved to private subnets only. NFS has no legitimate reason to be adjacent to public internet routing regardless of your current security group confidence level.
A customer-managed KMS key was created explicitly with a key policy and assigned to the file system. Automatic key rotation was enabled. One dollar a month for actual ownership of the encryption decision.
AWS Backup policy was reviewed, documented, and set deliberately - not left at whatever the account default happened to be.
EFS Intelligent-Tiering was enabled. The workload had substantial cold data. The cost difference was immediate.
The lesson isn’t that EFS is a bad choice
It isn’t. For shared file storage across multiple compute instances - applications that need POSIX-compliant, simultaneously accessible storage - it’s frequently exactly the right service.
The lesson is that fully managed describes the infrastructure, not the decisions. AWS manages the underlying storage fabric. You still own the key selection, the subnet placement, the backup policy, and the storage class. The console will happily accept the defaults and never flag that you just made four consequential choices without realizing it.
AWS certification teaches you what EFS does
The job teaches you what EFS does when you let the wizard decide.
Selena knew the service. Bart knew the service and the defaults.
Raja, who had been quiet through most of this, said one thing:
“Fully managed doesn’t mean fully decided.”
JJ added a fourth Post-it note. A red one. It was private.
The daily concept, question, and rationale arrive at dontknowjack.club every day at noon. Selena’s Crossword every Sunday. Free. No credit card.