Using aws efs with amplify

Question

Pulumi · Accepted Answer

To integrate AWS Elastic File System (EFS) with AWS Amplify, you generally need to create an EFS file system and connect it to an Amplify application by using an AWS Lambda function as an intermediary. AWS Lambda functions can mount an EFS file system and interact with it. Amplify can then invoke this AWS Lambda function through API Gateway or another trigger, enabling your Amplify application to access EFS.

Below you will find a Pulumi program in TypeScript that demonstrates how to create an EFS file system, a Lambda function with access to it, and an API Gateway to trigger the Lambda function.

This program will perform the following steps:
1. Create an EFS file system.
2. Create a mount target for the EFS within a specific subnet and security group.
3. Create an access point that the Lambda function will use to mount the EFS.
4. Create the Lambda function with the necessary IAM role and policies, and configure it to use the EFS access point.
5. Set up an API Gateway as a trigger for the Lambda function, exposing an HTTPS endpoint.

Before running this Pulumi program, ensure you have AWS credentials configured and Pulumi CLI installed.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an AWS EFS File System.
const fileSystem = new aws.efs.FileSystem("myFileSystem", {});

// Assume we have a VPC, subnet, and security group already available.
// Replace these placeholders with your actual VPC ID, Subnet ID, and Security Group ID.
const vpcId = 'vpc-123';
const subnetId = 'subnet-456';
const securityGroupId = 'sg-789';

// Create a mount target for the EFS file system.
const mountTarget = new aws.efs.MountTarget("myMountTarget", {
    fileSystemId: fileSystem.id,
    subnetId: subnetId,
    securityGroups: [securityGroupId],
});

// Create an EFS Access Point.
const accessPoint = new aws.efs.AccessPoint("myAccessPoint", {
    fileSystemId: fileSystem.id,
    // Define the POSIX user and permissions for the Lambda function to use.
    posixUser: {
        gid: 1001,
        uid: 1001,
    },
    rootDirectory: {
        // The Lambda function will have read/write access to this directory path.
        path: "/lambda",
        creationInfo: {
            ownerGid: 1001,
            ownerUid: 1001,
            permissions: "700",
        },
    },
});

// Create an IAM role and policy that allow the Lambda function to access the EFS.
const role = new aws.iam.Role("myLambdaRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "lambda.amazonaws.com" }),
});

// Attach the AWS managed policy for Lambda functions.
const policyAttachment = new aws.iam.RolePolicyAttachment("myLambdaRolePolicyAttachment", {
    role: role,
    policyArn: aws.iam.ManagedPolicies.AWSLambdaExecute,
});

// Create the Lambda function.
const lambdaFunction = new aws.lambda.Function("myLambdaFunction", {
    role: role.arn,
    handler: "index.handler",
    runtime: aws.lambda.Runtime.NodeJS12dX,
    code: new pulumi.asset.AssetArchive({
        '.': new pulumi.asset.FileArchive('./path/to/your/lambda/source/code')
    }),
    // The EFS configuration for the Lambda function.
    fileSystemConfigs: [{
        arn: accessPoint.arn,
        localMountPath: "/mnt/efs",
    }],
});

// Create an API Gateway to trigger the Lambda function.
const api = new aws.apigatewayv2.Api("api", {
    protocolType: "HTTP",
});

const lambdaIntegration = new aws.apigatewayv2.Integration("lambdaIntegration", {
    apiId: api.id,
    integrationType: "AWS_PROXY",
    integrationUri: lambdaFunction.arn,
});

const route = new aws.apigatewayv2.Route("route", {
    apiId: api.id,
    routeKey: "GET /files",
    target: pulumi.interpolate`integrations/${lambdaIntegration.id}`,
});

const stage = new aws.apigatewayv2.Stage("stage", {
    apiId: api.id,
    name: "stage",
    autoDeploy: true
});

// Export the API endpoint URL.
export const apiUrl = pulumi.interpolate`${api.apiEndpoint}/${stage.name}/files`;

// Ensure the Lambda function is created only after the EFS, Access Point, and Mount Target are ready.
lambdaFunction.dependsOn = [fileSystem, mountTarget, accessPoint];

```

### Explaining the Resources:

- **EFS FileSystem**: Provisioning an EFS FileSystem as the backbone of our file storage solution.
- **Mount Target**: Creating a mount target to place the file system in a subnet, making it accessible within the VPC.
- **Access Point**: Designing an access point to provide controlled access paths into the file system for the Lambda function.
- **IAM Role and Policy**: Setting up the IAM role and attaching a policy for the Lambda to execute and access the EFS.
- **Lambda Function**: Crafting the actual compute function which will interact with our EFS using a Node.js runtime.
- **API Gateway**: Exposing the Lambda function through an HTTPS endpoint, making it accessible for the Amplify application.

### Next Steps:

- After running this program with `pulumi up`, the API endpoint URL will be output.
- Use this URL in your Amplify application to interact with the file system via the Lambda function.
- Store your Lambda function's source code in the directory specified by the 'code' attribute.
- The Lambda handler should manage file operations which are intended to perform on EFS.

This code is a starting point to further customize for specific use cases. Make sure to set appropriate permissions for your Lambda function to access the EFS and feel free to add more functionality to your Lambda function to suit your needs.