本文へ移動
cccskills
無料GitHub で公開

troubleshooting-s3-files

Diagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues. Use when the user has an S3 file system that is not mounting, returning access denied, not syncing changes to S3, showing files in lost+found, or performing slower than expected.

aws/agent-toolkit-for-aws
インストール方法を見る

含まれるファイル（1）

  • SKILL.md7.0 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Troubleshooting S3 Files

Overview

Diagnoses and resolves Amazon S3 Files issues: mount failures, IAM permissions, synchronization, conflict resolution, and performance.

For authoritative guidance, see S3 Files Troubleshooting.

Common Tasks

0. Verify Dependencies

  • You MUST verify aws CLI is available with s3files subcommand support
  • You MUST confirm valid AWS credentials
  • You MUST ONLY check for tool existence and version — MUST NOT execute destructive or mutating commands during verification
  • You MUST inform the user if any required tools are missing
  • You MUST respect the user's decision to abort if tools are unavailable
  • You SHOULD explain steps before executing and wait for user confirmation on write commands

1. Classify the Issue

SymptomCategory
mount.s3files: command not foundA: Client Installation
Connection timed out during mountB: Network/Security Group
Mount hangs indefinitely (no timeout)B: Network/Security Group
Access denied during mountC: IAM Permissions
File system stuck in "creating"C: IAM Permissions
Permission denied on file operationsC: IAM Permissions
Files not appearing in S3 after writeD: Synchronization
Files in .s3files-lost+found directoryE: Conflict Resolution
Slow reads or high latencyF: Performance
NFS server errorG: Encryption/KMS
DNS name resolution failsH: VPC DNS

2. Category A — Client Installation

mount.s3files: command not found means amazon-efs-utils is missing or < v3.0.0.

sudo yum -y install amazon-efs-utils  # Amazon Linux

3. Category B — Network/Security Group

Connection timeout is the #1 mount failure — almost always security groups.

Verify mount target exists in the instance's AZ:

aws s3files list-mount-targets --file-system-id fs-ID --region REGION

Cross-AZ mounting works but adds latency.

Verify security groups — most common fix:

  • Mount target SG MUST have inbound TCP 2049 from compute SG
  • Compute SG MUST have outbound TCP 2049 to mount target SG
  • Fix: aws ec2 authorize-security-group-ingress --group-id sg-MT --protocol tcp --port 2049 --source-group sg-COMPUTE

Test connectivity:

nc -zv az-ID.fs-ID.s3files.REGION.on.aws 2049

Note: These SG troubleshooting steps also apply to EFS — use aws efs describe-mount-targets instead.

Mount hangs in isolated VPC: If the VPC has no internet access, S3 Files requires a CloudWatch Logs VPC endpoint (com.amazonaws.REGION.logs) for mount to complete.

4. Category C — IAM Permissions

File system stuck in "creating" status: S3 Files does NOT validate IAM role permissions at creation time. Wrong trust policy or missing permissions → stuck in creating with access denied in statusMessage.

Check status:

aws s3files get-file-system --file-system-id fs-ID --region REGION

Check statusMessage. If access denied, fix the IAM role and delete/recreate.

Mount access denied: Compute role needs s3files:ClientMount. For dev/test only, AmazonS3FilesClientFullAccess is acceptable — avoid in production.

Write permission denied: Compute role needs s3files:ClientWrite

Root access denied: Compute role needs s3files:ClientRootAccess. ⚠️ Bypasses POSIX permissions — prefer access points with scoped POSIX users.

Check file system policy:

aws s3files get-file-system-policy --file-system-id fs-ID --region REGION

5. Category D — Synchronization

Files not appearing in S3: Writes sync within ~60 seconds. Check status:

getfattr -n "user.s3files.status;$(date -u +%s)" filename --only-values

Common ExportError values:

ErrorFix
S3AccessDeniedFile system IAM role lacks S3 write permissions
S3BucketNotFoundBucket deleted or renamed
RoleAssumptionFailedTrust policy misconfigured
EncryptionKeyInaccessibleKMS key disabled or permissions revoked
PathTooLongFile path exceeds 1,024 byte S3 key limit

Monitor: PendingExports CloudWatch metric. Growing = exceeds 800 files/sec rate.

6. Category E — Conflict Resolution

Files in .s3files-lost+found-{fs-id} = sync conflict (modified via FS and S3 simultaneously). S3 wins; FS version moved to lost+found.

7. Category F — Performance

First access latency: Normal — first directory access imports metadata.

Intelligent read routing not working: Compute role needs s3:GetObject on the bucket.

Slow writes: If PendingExports growing, distribute across multiple file systems.

8. Category G — Encryption/KMS

NFS server error with encrypted FS = KMS issue. Verify key is enabled and role has KMS permissions.

9. Category H — VPC DNS

DNS resolution failure = VPC DNS settings disabled.

aws ec2 describe-vpc-attribute --vpc-id vpc-ID --attribute enableDnsHostnames
aws ec2 describe-vpc-attribute --vpc-id vpc-ID --attribute enableDnsSupport

Both MUST be true. If not:

aws ec2 modify-vpc-attribute --vpc-id vpc-ID --enable-dns-hostnames Value=true
aws ec2 modify-vpc-attribute --vpc-id vpc-ID --enable-dns-support Value=true

Troubleshooting

AWS CLI endpoint URL cannot be resolved

CLI is too old for S3 Files. Run aws --version — if v1.x, upgrade to AWS CLI v2: Installing the AWS CLI.

ECS task fails with DNS resolution error

Used efsVolumeConfiguration instead of s3filesVolumeConfiguration. Fix: use fileSystemArn in S3 Files-specific volume config.

S3 Files vs other products confusion

S3 Files is NOT Mountpoint for S3, S3 File Gateway, or File Cache. Uses aws s3files CLI, s3files: IAM actions, mount -t s3files.

Enable Debug Logs

Set logging_level = DEBUG in /etc/amazon/efs/s3files-utils.conf. Logs at /var/log/amazon/efs/mount.log.

Collect Logs for AWS Support

sudo tar -czf /tmp/s3files-logs.tar.gz /var/log/amazon/efs/ /etc/amazon/efs/s3files-utils.conf

Security Considerations

  • When diagnosing IAM issues, verify least-privilege — avoid FullAccess as a shortcut
  • Without a file system policy, any VPC client can mount
  • Restrict /var/log/amazon/efs/ access — logs contain S3 key names

Additional Resources

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

agent-advisor

無料

Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow. Triggers on: which runtime for my agent, AgentCore vs ECS vs EKS vs Lambda, AgentCore vs Lambda MicroVMs, deploy an AI agent on AWS, agent architecture on AWS, I have an agent idea what do I build, move/migrate my agents to AWS, agent migration plan, add AgentCore services (memory, gateway, identity, policy, observability) to an agent already on AWS, Temporal on AWS (migrate/run Temporal workers on AWS, a service orchestrated by Temporal, Temporal Cloud vs self-hosted). Temporal Workflow code is never rewritten into Step Functions. Requires at least one agentic component — a purely non-agent system (plain services, batch jobs, HTTP endpoints, non-agent Temporal Activities) is out of scope, redirected to gcp-to-aws / heroku-to-aws / llm-to-bedrock. Not for: compute/data migration with no AI agent; pure LLM SDK rewrite (use llm-to-bedrock); per-model pricing.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8532026年10月12日 更新

agents-build

無料

Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal. Triggers: "add memory", "remember across sessions", "call agent from app", "invoke agent from code", "agent auth", "streaming", "VPC", "VPC connectivity", "can't reach from VPC", "multi-agent", "A2A", "A2A auth", "orchestrator not delegating", "specialist not called", "migrate Bedrock Agent", "migration issue", "change model", "browser tool", "code interpreter", "delete agent", "tear down", "agentcore remove", "cross-account memory", "add payments capability to my agent", "wire payments plugin", "integrate x402 payments with the agent I'm building", "add MPP payments", "Machine Payments Protocol". External APIs via Gateway: use agents-connect. New project: use agents-get-started. CLI/dev-server errors: use agents-debug. Runtime x402/MPP payments: use agents-pay. Migration-specific Strands vs LangGraph routes here.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8532026年10月12日 更新

agents-connect

無料

Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: "connect to API", "add gateway", "connect to MCP server", "Lambda tools", "OpenAPI", "gateway target", "Cedar policy", "restrict tools", "policy engine", "gateway auth error", "store API key", "outbound credential", "env var API key", "API key None after deploy", "credential not available after deploy", "should this be a gateway target", "give my agent tools", "add tools to agent". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8532026年10月12日 更新

agents-debug

無料

Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: "agent not working", "wrong answer", "agent error", "tool call failing", "debug agent", "check logs", "read traces", "broken", "500 error", "424 error", "model access denied", "command not found", "stuck in DELETING", "maxVms exceeded", "cold start diagnosis", "cold start slow", "agentcore create error", "create failed", "exit code 7", "connection refused local dev". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8532026年10月12日 更新

agents-deploy

無料

Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK/IAM/quota error diagnosis, version management, rollback, and canary deployments. Triggers on: "deploy my agent", "agentcore deploy", "deploy failed", "CDK error", "rollback", "canary deploy", "pin version", "redeploy", "deploy stuck". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8532026年10月12日 更新

agents-get-started

無料

Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: "build an agent", "create an agent", "get started", "new project", "agentcore create", "which framework", "Strands vs LangGraph", "hello world agent", "first agent", "create MCP server", "host MCP server", "agentcore dev", "dev server", "what port", "local development". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.

日本語の概要は準備中です。原文の説明を表示しています。

aws/agent-toolkit-for-aws2,8532026年10月12日 更新

aws のスキルをすべて見る

このスキルの問題を報告する