본문으로 건너뛰기
cccskills
무료GitHub에 공개

troubleshooting-efs

Diagnoses and resolves Amazon EFS issues including mount failures, NFS timeouts, permission errors, throughput problems, and burst credit exhaustion. Use when the user has an EFS file system that is not mounting, returning errors, performing slowly, or showing access denied.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aws/agent-toolkit-for-aws
연동 도구AWS
설치 방법 보기

포함된 파일(1)

  • SKILL.md6.3 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Troubleshooting EFS

Overview

Domain expertise for diagnosing and resolving Amazon EFS issues. Covers mount failures, NFS connectivity, IAM and POSIX permissions, throughput and performance, and encryption problems.

For authoritative guidance, see EFS Troubleshooting.

Common Tasks

0. Verify Dependencies

  • You MUST verify aws CLI is available
  • You MUST check if amazon-efs-utils or nfs-utils is installed on the instance
  • You MUST ONLY check for tool existence and version — MUST NOT execute destructive or mutating commands during verification
  • You MUST inform the user if any required tools are missing
  • You MUST respect the user's decision to abort if tools are unavailable
  • You SHOULD explain what each step does and why before executing it
  • You SHOULD display write commands and wait for user confirmation before executing

1. Classify the Issue

SymptomCategory
"wrong fs type" or mount command failsA: Missing NFS Client
Connection timed out (hangs 2+ min)B: Network/Security Group
"access denied by server"C: IAM/Permissions
Slow throughput or high latencyD: Performance
NFS server error on encrypted FSE: Encryption/KMS
DNS name resolution failsF: VPC DNS

2. Category A — Missing NFS Client

# Amazon Linux / RHEL / CentOS
sudo yum -y install amazon-efs-utils  # preferred (includes mount helper + TLS)
# OR
sudo yum -y install nfs-utils

# Ubuntu / Debian
sudo apt-get install nfs-common

3. Category B — Network/Security Group

Connection timeout is the #1 EFS mount failure — almost always security groups.

  1. Verify mount target exists in the instance's AZ:
aws efs describe-mount-targets --file-system-id fs-ID --region REGION

  1. Verify security groups — check BOTH directions:

    • Mount target SG: aws ec2 describe-security-groups --group-ids sg-MT — MUST have inbound TCP 2049 from compute SG
    • Compute SG: MUST have outbound TCP 2049 to mount target SG
    • Quick fix: aws ec2 authorize-security-group-ingress --group-id sg-MT --protocol tcp --port 2049 --source-group sg-COMPUTE

  2. Test connectivity:

nc -zv fs-ID.efs.REGION.amazonaws.com 2049

Note: These security group troubleshooting steps also apply to S3 Files. The only difference is S3 Files uses aws s3files list-mount-targets instead of aws efs describe-mount-targets.

4. Category C — IAM/Permissions

"access denied by server" with -o iam:

  • Check identity-based IAM policy has elasticfilesystem:ClientMount
  • Check file system resource policy:
aws efs describe-file-system-policy --file-system-id fs-ID --region REGION

Note: IAM authorization is only enforced when a file system policy exists that requires it. Without a file system policy, any client in the VPC with port 2049 access can mount — even with -o iam. To enforce IAM, you MUST create a file system policy that denies anonymous access.

POSIX permission denied (not IAM):

  • Check file/directory ownership: ls -la /mnt/efs/
  • Use access points to enforce UID/GID for consistent permissions

5. Category D — Performance

Check throughput mode:

aws efs describe-file-systems --file-system-id fs-ID --region REGION --query 'FileSystems[0].ThroughputMode'

Burst credit exhaustion (Bursting mode only):

aws cloudwatch get-metric-statistics --namespace AWS/EFS --metric-name BurstCreditBalance --dimensions Name=FileSystemId,Value=fs-ID --period 3600 --statistics Average --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) --end-time $(date -u +%Y-%m-%dT%H:%M:%S)

If credits near zero, switch to Elastic throughput:

aws efs update-file-system --file-system-id fs-ID --throughput-mode elastic --region REGION

General Purpose vs Max I/O:

  • Check PercentIOLimit metric — if consistently >80%, consider Max I/O
  • Note: performance mode is IMMUTABLE — must create new FS and migrate

6. Category E — Encryption/KMS

NFS server error on encrypted FS = KMS key issue.

  • Verify key is enabled in KMS console
  • Verify EFS service-linked role has KMS permissions
  • If key deleted: cancel deletion if within grace period

7. Category F — VPC DNS

DNS resolution failure = VPC DNS settings disabled.

aws ec2 describe-vpc-attribute --vpc-id vpc-ID --attribute enableDnsHostnames
aws ec2 describe-vpc-attribute --vpc-id vpc-ID --attribute enableDnsSupport

Both MUST be true. If not:

aws ec2 modify-vpc-attribute --vpc-id vpc-ID --enable-dns-hostnames Value=true
aws ec2 modify-vpc-attribute --vpc-id vpc-ID --enable-dns-support Value=true

Troubleshooting

Mount hangs then times out

Most common cause: security group. Verify TCP 2049 is open between compute and mount target.

Auto-mount fails on reboot

/etc/fstab entry MUST include _netdev option to wait for network before mounting.

"nfs not responding" after reconnect

Old kernel bug with TCP port reuse. Update kernel or add noresvport mount option.

Enable Debug Logs

Set logging_level = DEBUG in /etc/amazon/efs/efs-utils.conf. Logs at /var/log/amazon/efs/mount.log.

Collect Logs for AWS Support

sudo tar -czf /tmp/efs-logs.tar.gz /var/log/amazon/efs/ /etc/amazon/efs/efs-utils.conf

Security Considerations

  • IAM authorization is only enforced when a file system policy exists — without one, any VPC client with port 2049 access can mount
  • When troubleshooting access denied, verify both identity-based and resource-based policies
  • Use -o tls for encryption in transit — unencrypted NFS traffic is visible on the network
  • Restrict /var/log/amazon/efs/ access — logs may contain file system IDs and mount target IPs

Additional Resources

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

agent-advisor

무료

Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow. Triggers on: which runtime for my agent, AgentCore vs ECS vs EKS vs Lambda, AgentCore vs Lambda MicroVMs, deploy an AI agent on AWS, agent architecture on AWS, I have an agent idea what do I build, move/migrate my agents to AWS, agent migration plan, add AgentCore services (memory, gateway, identity, policy, observability) to an agent already on AWS, Temporal on AWS (migrate/run Temporal workers on AWS, a service orchestrated by Temporal, Temporal Cloud vs self-hosted). Temporal Workflow code is never rewritten into Step Functions. Requires at least one agentic component — a purely non-agent system (plain services, batch jobs, HTTP endpoints, non-agent Temporal Activities) is out of scope, redirected to gcp-to-aws / heroku-to-aws / llm-to-bedrock. Not for: compute/data migration with no AI agent; pure LLM SDK rewrite (use llm-to-bedrock); per-model pricing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aws/agent-toolkit-for-aws2.9천2026년 10월 19일 업데이트

agents-build

무료

Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal. Triggers: "add memory", "remember across sessions", "call agent from app", "invoke agent from code", "agent auth", "streaming", "VPC", "VPC connectivity", "can't reach from VPC", "multi-agent", "A2A", "A2A auth", "orchestrator not delegating", "specialist not called", "migrate Bedrock Agent", "migration issue", "change model", "browser tool", "code interpreter", "delete agent", "tear down", "agentcore remove", "cross-account memory", "add payments capability to my agent", "wire payments plugin", "integrate x402 payments with the agent I'm building", "add MPP payments", "Machine Payments Protocol". External APIs via Gateway: use agents-connect. New project: use agents-get-started. CLI/dev-server errors: use agents-debug. Runtime x402/MPP payments: use agents-pay. Migration-specific Strands vs LangGraph routes here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aws/agent-toolkit-for-aws2.9천2026년 10월 19일 업데이트

agents-connect

무료

Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: "connect to API", "add gateway", "connect to MCP server", "Lambda tools", "OpenAPI", "gateway target", "Cedar policy", "restrict tools", "policy engine", "gateway auth error", "store API key", "outbound credential", "env var API key", "API key None after deploy", "credential not available after deploy", "should this be a gateway target", "give my agent tools", "add tools to agent". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aws/agent-toolkit-for-aws2.9천2026년 10월 19일 업데이트

agents-debug

무료

Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: "agent not working", "wrong answer", "agent error", "tool call failing", "debug agent", "check logs", "read traces", "broken", "500 error", "424 error", "model access denied", "command not found", "stuck in DELETING", "maxVms exceeded", "cold start diagnosis", "cold start slow", "agentcore create error", "create failed", "exit code 7", "connection refused local dev". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aws/agent-toolkit-for-aws2.9천2026년 10월 19일 업데이트

agents-deploy

무료

Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK/IAM/quota error diagnosis, version management, rollback, and canary deployments. Triggers on: "deploy my agent", "agentcore deploy", "deploy failed", "CDK error", "rollback", "canary deploy", "pin version", "redeploy", "deploy stuck". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aws/agent-toolkit-for-aws2.9천2026년 10월 19일 업데이트

agents-get-started

무료

Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: "build an agent", "create an agent", "get started", "new project", "agentcore create", "which framework", "Strands vs LangGraph", "hello world agent", "first agent", "create MCP server", "host MCP server", "agentcore dev", "dev server", "what port", "local development". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aws/agent-toolkit-for-aws2.9천2026년 10월 19일 업데이트

aws의 스킬 모두 보기

이 스킬의 문제 신고