title: Providing access to EFS from ECS task
body: <p>I am struggling to get an ECS task to be able to see an EFS volume.
  The terraform config is:</p>
  <p><strong>EFS DEFINITION</strong></p>
  <pre><code>resource &quot;aws_efs_file_system&quot; &quot;persistent&quot; {
  encrypted = true
  }
  
  resource &quot;aws_efs_access_point&quot; &quot;access&quot; {
    file_system_id = aws_efs_file_system.persistent.id
  }
  
  resource &quot;aws_efs_mount_target&quot; &quot;mount&quot; {
    for_each = {for net in aws_subnet.private : net.id =&gt; {id = net.id}}
    file_system_id = aws_efs_file_system.persistent.id
    subnet_id      = each.value.id
    security_groups = [aws_security_group.efs.id]
  }
  </code></pre>
  <hr />
  <p><strong>TASK DEFINITION</strong></p>
  <pre><code>resource &quot;aws_ecs_task_definition&quot; &quot;app&quot; {
    family                   = &quot;backend-app-task&quot;
    execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn
    task_role_arn = aws_iam_role.ecs_task_role.arn
    network_mode             = &quot;awsvpc&quot;
    requires_compatibilities = [&quot;FARGATE&quot;]
    cpu                      = var.fargate_cpu
    memory                   = var.fargate_memory
    container_definitions    = data.template_file.backendapp.rendered
    volume {
      name = &quot;persistent&quot;
  
      efs_volume_configuration {
        file_system_id          = aws_efs_file_system.persistent.id
        root_directory          = &quot;/opt/data&quot;
        transit_encryption      = &quot;ENABLED&quot;
        transit_encryption_port = 2999
        authorization_config {
          access_point_id = aws_efs_access_point.access.id
          iam             = &quot;ENABLED&quot;
        }
      }
    }
  }
  </code></pre>
  <hr />
  <p><strong>SECURITY GROUP</strong></p>
  <pre><code>resource &quot;aws_security_group&quot; &quot;efs&quot; {
    name        = &quot;efs-security-group&quot;
    vpc_id      = aws_vpc.main.id
  
    ingress {
      protocol        = &quot;tcp&quot;
      from_port       = 2999
      to_port         = 2999
      security_groups = [aws_security_group.ecs_tasks.id]
      cidr_blocks = [for net in aws_subnet.private : net.cidr_block]
    }
  }
  </code></pre>
  <hr />
  <p><strong>TASK ROLE</strong></p>
  <pre><code>resource &quot;aws_iam_role&quot; &quot;ecs_task_role&quot; {
    name               = &quot;ecsTaskRole&quot;
  
    assume_role_policy  = data.aws_iam_policy_document.ecs_task_execution_role_base.json
    managed_policy_arns = [&quot;arn:aws:iam::aws:policy/AmazonElasticFileSystemFullAccess&quot;,&quot;arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy&quot;, aws_iam_policy.ecs_exec_policy.arn]
  }
  </code></pre>
  <p>As I understand the AWS docs, the IAM role should have access, and the security group should be passing traffic, but the error suggests that the task cannot resolve the EFS instance.</p>
  <p>The error message is:</p>
  <pre><code>ResourceInitializationError: failed to invoke EFS utils commands to set up EFS volumes: stderr: Failed to resolve &quot;fs-0000000000000.efs.eu-west-2.amazonaws.com&quot; - check that your file system ID is correct. 
  </code></pre>
  <p>I've manually confirmed in the console that the EFS id is correct, so I can only conclude that it cannot resolve due to a network/permissions issue.</p>
  <p>-- EDIT --
  <strong>ECS SERVICE DEFINITION</strong></p>
  <pre><code>resource &quot;aws_ecs_service&quot; &quot;main&quot; {
    name            = &quot;backendservice&quot;
    cluster         = aws_ecs_cluster.main.id
    task_definition = aws_ecs_task_definition.app.arn
    desired_count   = var.app_count
    launch_type     = &quot;FARGATE&quot;
    enable_execute_command = true
  
    network_configuration {
      security_groups  = [aws_security_group.ecs_tasks.id]
      subnets          = aws_subnet.private.*.id
      assign_public_ip = true
    }
  
    load_balancer {
      target_group_arn = aws_alb_target_group.app.id
      container_name   = &quot;server&quot;
      container_port   = var.app_port
    }
  
    depends_on = [aws_alb_listener.backend]
  }
  </code></pre>
  <p><strong>ECS TASK SECURITY GROUP</strong></p>
  <pre><code>resource &quot;aws_security_group&quot; &quot;ecs_tasks&quot; {
    name        = &quot;backend-ecs-tasks-security-group&quot;
    description = &quot;allow inbound access from the ALB only&quot;
    vpc_id      = aws_vpc.main.id
  
    ingress {
      protocol        = &quot;tcp&quot;
      from_port       = var.app_port
      to_port         = var.app_port
      security_groups = [aws_security_group.lb.id]
    }
  
    egress {
      protocol    = &quot;-1&quot;
      from_port   = 0
      to_port     = 0
      cidr_blocks = [&quot;0.0.0.0/0&quot;]
    }
  }
  </code></pre>
  <p><strong>VPC DEFINITION (minus internet gateway)</strong></p>
  <pre><code>data &quot;aws_availability_zones&quot; &quot;available&quot; {
  }
  
  resource &quot;aws_vpc&quot; &quot;main&quot; {
    cidr_block = &quot;172.17.0.0/16&quot;
  }
  
  # Create var.az_count private subnets, each in a different AZ
  resource &quot;aws_subnet&quot; &quot;private&quot; {
    count             = var.az_count
    cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)
    availability_zone = data.aws_availability_zones.available.names[count.index]
    vpc_id            = aws_vpc.main.id
  }
  
  resource &quot;aws_subnet&quot; &quot;public&quot; {
    count                   = var.az_count
    cidr_block              = cidrsubnet(aws_vpc.main.cidr_block, 8, var.az_count + count.index)
    availability_zone       = data.aws_availability_zones.available.names[count.index]
    vpc_id                  = aws_vpc.main.id
    map_public_ip_on_launch = true
  }
  </code></pre>
  <hr />
  <h2>EDIT</h2>
  <p>It turned out the mountPoints block was missing from the container template. I have now added it, but the outcome is the same.</p>