title: Attaching an EFS volume to Fargate?
body: <p>I know this question has been asked before, and I've seen several of the SO responses and read the AWS docs on the subject... I have a terraform module that, in part, builds out an ECS service, cluster, task, and Fargate container:</p>
  <pre><code>###############################################################################
  #### EFS for added stoage
  #### TODO: remove in favor of larger ephmemeral storage when terraform supports it
  ###############################################################################
  resource &quot;aws_efs_file_system&quot; &quot;test&quot; {
    creation_token = var.fargate_container_name
  
    tags = {
      Name = &quot;test&quot;
    }
  }
  
  resource &quot;aws_efs_access_point&quot; &quot;test&quot; {
    file_system_id = aws_efs_file_system.test.id
    root_directory {
      path = &quot;/&quot;
    }
  }
  
  resource &quot;aws_efs_mount_target&quot; &quot;test&quot; {
    count           = 3
    file_system_id  = aws_efs_file_system.test.id
    subnet_id       = local.directory_subnet_ids[count.index]
    security_groups = [aws_security_group.test_ecs.id]
  }
  
  ###############################################################################
  #### ECS Task and Service
  ###############################################################################
  resource &quot;aws_ecs_task_definition&quot; &quot;test&quot; {
    family                   = &quot;test&quot;
    requires_compatibilities = [&quot;FARGATE&quot;]
    cpu                      = var.test_cpu_limit
    memory                   = var.test_memory_limit
    container_definitions    = &lt;&lt;JSON
  [
        {
            &quot;name&quot;: &quot;test&quot;,
            &quot;image&quot;: &quot;${var.test_image_registry_repo_and_image_name}&quot;,
            &quot;memory&quot;: ${var.test_memory_limit},
            &quot;cpu&quot;: ${var.test_cpu_limit},
            &quot;essential&quot;: true,
            &quot;portMappings&quot;: [
              {
                &quot;containerPort&quot;: 7001,
                &quot;hostPort&quot;: 7001,
                &quot;protocol&quot;: &quot;tcp&quot;
              },
              {
                &quot;containerPort&quot;: 7002,
                &quot;hostPort&quot;: 7002,
                &quot;protocol&quot;: &quot;tcp&quot;
              },
              {
                &quot;containerPort&quot;: 9001,
                &quot;hostPort&quot;: 9001,
                &quot;protocol&quot;: &quot;tcp&quot;
              },
              {
                &quot;containerPort&quot;: 9002,
                &quot;hostPort&quot;: 9002,
                &quot;protocol&quot;: &quot;tcp&quot;
              }
            ],
            &quot;logConfiguration&quot;: {
                &quot;logDriver&quot;: &quot;awslogs&quot;,
                &quot;options&quot;: {
                    &quot;awslogs-group&quot;: &quot;${aws_cloudwatch_log_group.test_ecs.name}&quot;,
                    &quot;awslogs-region&quot;: &quot;${data.aws_region.main.name}&quot;,
                    &quot;awslogs-stream-prefix&quot;: &quot;ecs&quot;
                }
            },
            &quot;linuxParameters&quot;: {
              &quot;initProcessEnabled&quot;: true
            },
            &quot;mountPoints&quot;: [
            {
              &quot;containerPath&quot;: &quot;/&quot;,
              &quot;sourceVolume&quot;: &quot;${var.fargate_container_name}&quot;
            }
          ]
        }
  ]
  JSON
    volume {
      name = var.fargate_container_name
  
      efs_volume_configuration {
        file_system_id          = aws_efs_file_system.test.id
        transit_encryption      = &quot;ENABLED&quot;
        transit_encryption_port = 2049
        authorization_config {
          access_point_id = aws_efs_access_point.test.id
          iam             = &quot;ENABLED&quot;
        }
      }
    }
  
    network_mode = &quot;awsvpc&quot;
    # The role used by ECS to pull images and the like.
    execution_role_arn = aws_iam_role.test_ecs_execution.arn
    task_role_arn      = aws_iam_role.test_task_ecs.arn
  
    tags = merge(
      local.tags, {
        &quot;Name&quot; = &quot;test&quot;
      }
    )
  }
  
  resource &quot;aws_ecs_service&quot; &quot;test&quot; {
    name                   = &quot;test&quot;
    cluster                = aws_ecs_cluster.test.id
    task_definition        = aws_ecs_task_definition.test.arn
    desired_count          = var.test_desired_count
    enable_execute_command = true
    platform_version       = &quot;1.4.0&quot;
  
    # service_registries {
    #   registry_arn   = aws_service_discovery_service.test.arn
    #   container_name = &quot;test&quot;
    # }
  
    capacity_provider_strategy {
      base              = var.fargate_capacity_provider_base_value
      capacity_provider = &quot;FARGATE&quot;
      weight            = var.fargate_capacity_provider_weight_value
    }
  
    capacity_provider_strategy {
      base              = var.fargate_spot_capacity_provider_base_value
      capacity_provider = &quot;FARGATE_SPOT&quot;
      weight            = var.fargate_spot_capacity_provider_weight_value
    }
  
    network_configuration {
      security_groups = [aws_security_group.test_ecs.id]
      subnets         = local.directory_subnet_ids
    }
  
    tags = merge(
      local.tags, {
        &quot;Name&quot; = &quot;test&quot;
      }
    )
  }
  
  resource &quot;aws_security_group&quot; &quot;test_ecs&quot; {
    name_prefix = &quot;test-ecs&quot;
    description = &quot;Allow strict inbound access to ECS Tasks&quot;
    vpc_id      = data.aws_vpc.primary.id
  
    ingress {
      from_port   = 2049
      to_port     = 2049
      protocol    = &quot;tcp&quot;
      cidr_blocks = [data.aws_vpc.primary.cidr_block]
    }
  
    ingress {
      from_port   = 7001
      to_port     = 7002
      protocol    = &quot;tcp&quot;
      cidr_blocks = [&quot;0.0.0.0/0&quot;]
    }
  
    ingress {
      from_port   = 9001
      to_port     = 9002
      protocol    = &quot;tcp&quot;
      cidr_blocks = [&quot;0.0.0.0/0&quot;]
    }
  
    egress {
      from_port   = 0
      to_port     = 0
      protocol    = &quot;-1&quot;
      cidr_blocks = [&quot;0.0.0.0/0&quot;]
    }
  
    tags = merge(
      local.tags, {
        &quot;Name&quot; = &quot;test-ecs&quot;
      }
    )
  }
  
  resource &quot;aws_iam_role&quot; &quot;test_task_ecs&quot; {
    name                 = &quot;EST&quot;
    description          = &quot;Test.&quot;
    permissions_boundary = data.aws_iam_policy.role_permissions_boundary.arn
    assume_role_policy   = &lt;&lt;POLICY
  {
    &quot;Version&quot;: &quot;2008-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Sid&quot;: &quot;&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;ecs-tasks.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  POLICY
  }
  </code></pre>
  <p>I've explicitly set the Fargate version in the service, I saw some other SO user answered stating that the VPC needed to have DNS hostnames and resolution set to true -- they are. I'm still getting the error:</p>
  <p>container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: rootfs_linux.go:71: creating device nodes caused: errno 524</p>
  <p>It seems to be connected to &quot;mountPoints&quot; block in the container definition, as removing it will at least start the container, but it will not mount the EFS volume.</p>
  <p>EDIT: Added ECS Task role</p>
  <p>EDIT 2: Adding role permissions boundary:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;UseServices&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;organizations:DescribeOrganization&quot;,
                  &quot;cloudshell:*&quot;,
                  &quot;compute-optimizer:*&quot;,
                  &quot;amplify:*&quot;,
                  &quot;appmesh:*&quot;,
                  &quot;appmesh-preview:*&quot;,
                  &quot;appconfig:*&quot;,
                  &quot;appflow:*&quot;,
                  &quot;clouddirectory:*&quot;,
                  &quot;datapipeline:*&quot;,
                  &quot;dms:*&quot;,
                  &quot;dbqms:*&quot;,
                  &quot;devicefarm:*&quot;,
                  &quot;devops-guru:*&quot;,
                  &quot;ds:*&quot;,
                  &quot;autoscaling:*&quot;,
                  &quot;imagebuilder:*&quot;,
                  &quot;ec2-instance-connect:*&quot;,
                  &quot;ecr-public:*&quot;,
                  &quot;forecast:*&quot;,
                  &quot;honeycode:*&quot;,
                  &quot;proton:*&quot;,
                  &quot;rds-db:*&quot;,
                  &quot;rds-data:*&quot;,
                  &quot;access-analyzer:*&quot;,
                  &quot;ce:*&quot;,
                  &quot;cur:*&quot;,
                  &quot;health:*&quot;,
                  &quot;pricing:*&quot;,
                  &quot;ram:Get*&quot;,
                  &quot;ram:List*&quot;,
                  &quot;servicequotas:*&quot;,
                  &quot;ssm:*&quot;,
                  &quot;ssmmessages:*&quot;,
                  &quot;support:*&quot;,
                  &quot;tag:*&quot;,
                  &quot;cloudfront:*&quot;,
                  &quot;elasticloadbalancing:*&quot;,
                  &quot;ecs:*&quot;,
                  &quot;ecr:*&quot;,
                  &quot;cloudwatch:*&quot;,
                  &quot;synthetics:*&quot;,
                  &quot;servicequotas:*&quot;,
                  &quot;apigateway:*&quot;,
                  &quot;rds:*&quot;,
                  &quot;secretsmanager:*&quot;,
                  &quot;route53:*&quot;,
                  &quot;acm:*&quot;,
                  &quot;resource-groups:*&quot;,
                  &quot;servicediscovery:*&quot;,
                  &quot;application-autoscaling:*&quot;,
                  &quot;ec2messages:*&quot;,
                  &quot;trustedadvisor:*&quot;,
                  &quot;cloud9:*&quot;,
                  &quot;codeartifact:*&quot;,
                  &quot;codebuild:*&quot;,
                  &quot;codecommit:*&quot;,
                  &quot;codedeploy:*&quot;,
                  &quot;codepipeline:*&quot;,
                  &quot;codestar:*&quot;,
                  &quot;codestar-connections:*&quot;,
                  &quot;codestar-notifications:*&quot;,
                  &quot;cognito-identity:*&quot;,
                  &quot;cognito-idp:*&quot;,
                  &quot;cognito-sync:*&quot;,
                  &quot;dynamodb:*&quot;,
                  &quot;eks:*&quot;,
                  &quot;emr-containers:*&quot;,
                  &quot;elasticache:*&quot;,
                  &quot;elasticbeanstalk:*&quot;,
                  &quot;elasticfilesystem:*&quot;,
                  &quot;firehose:*&quot;,
                  &quot;kafka:*&quot;,
                  &quot;kinesis:*&quot;,
                  &quot;kinesisanalytics:*&quot;,
                  &quot;serverlessrepo:*&quot;,
                  &quot;sqs:*&quot;,
                  &quot;xray:*&quot;,
                  &quot;workspaces:*&quot;,
                  &quot;wam:*&quot;,
                  &quot;appsync:*&quot;,
                  &quot;athena:*&quot;,
                  &quot;batch:*&quot;,
                  &quot;states:*&quot;,
                  &quot;backup:*&quot;,
                  &quot;backup-storage:*&quot;,
                  &quot;es:*&quot;,
                  &quot;glue:*&quot;,
                  &quot;databrew:*&quot;,
                  &quot;lightsail:*&quot;,
                  &quot;timestream:*&quot;,
                  &quot;schemas:*&quot;,
                  &quot;ec2:*&quot;,
                  &quot;sts:AssumeRole&quot;,
                  &quot;sts:TagSession&quot;,
                  &quot;cloudformation:*&quot;,
                  &quot;lambda:*&quot;,
                  &quot;s3:*&quot;,
                  &quot;sns:*&quot;,
                  &quot;events:*&quot;,
                  &quot;kms:*&quot;,
                  &quot;logs:*&quot;,
                  &quot;cloudtrail:*&quot;,
                  &quot;iam:ListAccountAliases&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          },
          {
              &quot;Sid&quot;: &quot;AllowServiceLinkedRole&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;iam:CreateServiceLinkedRole&quot;,
                  &quot;iam:DeleteServiceLinkedRole&quot;,
                  &quot;iam:GetServiceLinkedRoleDeletionStatus&quot;,
                  &quot;iam:UpdateRole&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:iam::*:role/aws-service-role/*&quot;
              ]
          },
          {
              &quot;Sid&quot;: &quot;AllowPolicy&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;iam:GetPolicy&quot;,
                  &quot;iam:DeletePolicy&quot;,
                  &quot;iam:CreatePolicy&quot;,
                  &quot;iam:GetPolicyVersion&quot;,
                  &quot;iam:CreatePolicyVersion&quot;,
                  &quot;iam:DeletePolicyVersion&quot;,
                  &quot;iam:ListPolicyVersions&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:iam::*:policy/*&quot;
              ]
          },
          {
              &quot;Sid&quot;: &quot;AllowReadRole&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;iam:GetRole&quot;,
                  &quot;iam:DeleteRole&quot;,
                  &quot;iam:TagRole&quot;,
                  &quot;iam:UpdateRoleDescription&quot;,
                  &quot;iam:ListInstanceProfilesForRole&quot;,
                  &quot;iam:ListAttachedRolePolicies&quot;,
                  &quot;iam:ListRolePolicies&quot;,
                  &quot;iam:UpdateAssumeRolePolicy&quot;,
                  &quot;iam:PassRole&quot;,
                  &quot;iam:GetRolePolicy&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:iam::*:role/*&quot;
              ]
          },
          {
              &quot;Sid&quot;: &quot;AllowWriteRole&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;iam:CreateRole&quot;,
                  &quot;iam:DeleteRolePolicy&quot;,
                  &quot;iam:AttachRolePolicy&quot;,
                  &quot;iam:DetachRolePolicy&quot;,
                  &quot;iam:PutRolePermissionsBoundary&quot;,
                  &quot;iam:PutRolePolicy&quot;,
                  &quot;iam:UpdateRole&quot;,
                  &quot;iam:PassRole&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;,
              &quot;Condition&quot;: {
                  &quot;StringEquals&quot;: {
                      &quot;iam:PermissionsBoundary&quot;: &quot;arn:aws:iam::835718480179:policy/CuriPipelineAdministratorAccessPermBoundaries&quot;
                  }
              }
          },
          {
              &quot;Sid&quot;: &quot;AllowWriteInstanceProfile&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;iam:AddRoleToInstanceProfile&quot;,
                  &quot;iam:CreateInstanceProfile&quot;,
                  &quot;iam:DeleteInstanceProfile&quot;,
                  &quot;iam:GetInstanceProfile&quot;,
                  &quot;iam:ListInstanceProfiles&quot;,
                  &quot;iam:RemoveRoleFromInstanceProfile&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:iam::*:instance-profile/*&quot;
              ]
          },
          {
              &quot;Sid&quot;: &quot;DenyIamActions&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Action&quot;: [
                  &quot;iam:*OpenIDConnect*&quot;,
                  &quot;iam:*SAMLProvider*&quot;,
                  &quot;iam:*User*&quot;,
                  &quot;iam:*Group*&quot;,
                  &quot;iam:*AccessKey*&quot;,
                  &quot;iam:*Password*&quot;,
                  &quot;iam:CreateAccountAliases&quot;,
                  &quot;iam:DeleteAccountAliases&quot;,
                  &quot;iam:*LoginProfile*&quot;,
                  &quot;iam:*ServiceSpecificCredential*&quot;,
                  &quot;iam:*MFADevice*&quot;,
                  &quot;iam:*CredentialReport*&quot;,
                  &quot;iam:*OrganizationsAccessReport*&quot;,
                  &quot;iam:*SecurityTokenServicePreferences*&quot;,
                  &quot;iam:GetAccountAuthorizationDetails&quot;,
                  &quot;iam:GetAccountSummary&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          },
          {
              &quot;Sid&quot;: &quot;NoBoundaryPolicyEdit&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Action&quot;: [
                  &quot;iam:CreatePolicyVersion&quot;,
                  &quot;iam:DeletePolicy&quot;,
                  &quot;iam:DeletePolicyVersion&quot;,
                  &quot;iam:SetDefaultPolicyVersion&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:iam::835718480179:policy/CuriPipelineAdministratorAccessPermBoundaries&quot;
              ]
          },
          {
              &quot;Sid&quot;: &quot;NoSelfRoleEdit&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Action&quot;: [
                  &quot;iam:Add*&quot;,
                  &quot;iam:Attach*&quot;,
                  &quot;iam:Change*&quot;,
                  &quot;iam:Create*&quot;,
                  &quot;iam:Delete*&quot;,
                  &quot;iam:Deactivate*&quot;,
                  &quot;iam:Detach*&quot;,
                  &quot;iam:Enable*&quot;,
                  &quot;iam:Update*&quot;,
                  &quot;iam:Put*&quot;,
                  &quot;iam:Remove*&quot;,
                  &quot;iam:Reset*&quot;,
                  &quot;iam:Tag*&quot;,
                  &quot;iam:Untag*&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:iam::835718480179:role/CuriPipelineAdministratorAccess&quot;
              ]
          }
      ]
  }
  </code></pre>