Inter-Container Communication using AWS EFS Access Points

Question

Pulumi · Accepted Answer

To facilitate inter-container communication using AWS EFS access points, you will need to create an EFS filesystem and then create an access point within that filesystem. This setup will allow multiple containers to interact with the same filesystem safely, as access points can enforce specific permissions for containerized applications.

Let's break it down into steps for better understanding:

1. **Create an EFS FileSystem**: The first step is to set up an EFS FileSystem. AWS Elastic File System (EFS) provides a simple, scalable, and fully managed elastic NFS file system for use with AWS Cloud services and on-premises resources.

2. **Create an EFS Access Point**: Once you have the file system, you'll create an EFS Access Point. Access points are application-specific entry points into an EFS file system that make it easier to manage application access to shared datasets. Access points can enforce a user identity for all file system requests that are made through the access point, and they can also enforce a root directory for the application.

Below is a Pulumi program written in Python that will set up an AWS EFS file system and an access point within that file system, which can then be used to enable inter-container communication.

```python
import pulumi
import pulumi_aws as aws

# Create an Elastic File System (EFS)
efs_filesystem = aws.efs.FileSystem("myEfsFileSystem",
    encrypted=True,
    tags={
        "Name": "MyEfsFileSystem",
    })

# Create an EFS Access Point
efs_access_point = aws.efs.AccessPoint("myEfsAccessPoint",
    file_system_id=efs_filesystem.id,
    posix_user=aws.efs.AccessPointPosixUserArgs(
        gid=1001,
        uid=1001,
    ),
    root_directory=aws.efs.AccessPointRootDirectoryArgs(
        # If the directory does not already exist, EFS creates it with these permissions when the access point is mounted.
        creation_info=aws.efs.AccessPointRootDirectoryCreationInfoArgs(
            owner_gid=1001,
            owner_uid=1001,
            permissions="755", # RWE for owner, Read/Execute for others.
        ),
        path="/export", # The path on the EFS filesystem to expose as the root directory to NFS clients using the access point.
    ),
    tags={
        "Name": "MyEfsAccessPoint",
    })

# Export the access point ID and file system ID
pulumi.export("efs_filesystem_id", efs_filesystem.id)
pulumi.export("efs_access_point_id", efs_access_point.id)
```

This code does the following:
- Creates an EFS file system with encryption enabled and tags it for identification.
- Within that file system, it creates an access point which specifies the UID and GID that the NFS client should use, effectively controlling access at the file level.
- It sets up a `root_directory` which is the path that will be exposed when containers try to communicate with the EFS. If the specified directory doesn't exist, EFS will create it with the permissions '755', which give full permissions to the owner, and read and execute permissions to others.
- Finally, it exports the IDs of the file system and the access point, so you can easily retrieve these values from the Pulumi stack output, which can then be used to configure your containers to use the access point for storage.

For the containers to communicate through the EFS, you will need to ensure that your container orchestrator (like ECS or Kubernetes) mounts the EFS filesystem at the access point and that your container's IAM roles have the necessary permissions to read and write to the EFS.

Keep in mind that for using EFS within a Kubernetes cluster, you would also need to configure the Kubernetes volume as an NFS mount point with the EFS details. This would involve creating a Persistent Volume (PV) and Persistent Volume Claim (PVC) that reference your EFS file system and access point.

Remember to replace the `gid` and `uid` in `pulumi_aws.efs.AccessPointPosixUserArgs` with the actual user and group IDs you want the access point to use. The user/group IDs may need to correspond to those within your container(s) so that file permissions are correctly handled.