亚马逊弹性文件系统策略 (EFS) - 允许通过 IAM 角色访问 EC2 实例不起作用

Question

我希望只有具有 IAM 角色123的实例才能挂载和读/写 EFS。

但是我无法安装。

我将不胜感激帮助和想法。

sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport fs-d2f2bd.efs.us-east-1.amazonaws.com:/ /var/www/mout

错误： mount.nfs4: access denied by server while mounting fs-d2f2bd.efs.us-east-1.amazonaws.com:/

我使用此策略创建了一个 EFS：

{
    "Version": "2012-10-17",
    "Id": "efs-policy-wizard-06f9ed35-1f72-48f9-b04a-21de6e54324c",
    "Statement": [
        {
            "Sid": "efs-statement-37f69742-4d0b-4a28-850f-36db1b192872",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::714154805721:role/123"
            },
            "Action": [
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:ClientMount"
            ],
            "Resource": "arn:aws:elasticfilesystem:us-east-1:714154805721:file-system/fs-d2f2bd"
        }
    ]
}

我创建了123 个角色

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "elasticfilesystem:CreateMountTarget",
                "elasticfilesystem:ClientMount",
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:CreateFileSystem"
            ],
            "Resource": "arn:aws:elasticfilesystem:us-east-1:714154805721:file-system/fs-09d2f2bd"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "elasticfilesystem:CreateFileSystem",
            "Resource": "*"
        }
    ]
}

最良好的祝愿，罗斯季斯拉夫

Answer 1

文档说您需要将-o iam传递给 mount 命令。