AWS EFS挂载Fargate/ECS容器报错排查求助

容器启动时抛出错误：

Resourceinitializationerror: failed to invoke EFS utils commands to set up EFS volumes: stderr: b'mount.nfs4: access denied by server while mounting 127.0.0.1:/' : unsuccessful EFS utils command execution; code: 32

已通过Linux实例测试过EFS实例，且按照官方教程配置，但仍出现上述错误。以下是相关配置：

安全组配置 #

EFS安全组 #

• 入站规则：
  • TCP 2049：允许10.0.0.0/16（VPC CIDR）访问
  • 所有协议所有端口：允许容器安全组sg-0bd22...访问
• 出站规则：所有协议所有端口允许访问0.0.0.0/0

容器安全组 #

• 入站规则：所有协议所有端口允许访问0.0.0.0/0
• 出站规则：所有协议所有端口允许访问0.0.0.0/0

任务定义 #

{
    "ipcMode": null,
    "executionRoleArn": "arn:aws:iam::327425660322:role/ecsTaskExecutionRole",
    "containerDefinitions": [
        {
            "dnsSearchDomains": null,
            "environmentFiles": null,
            "logConfiguration": {
                "logDriver": "awslogs",
                "secretOptions": null,
                "options": {
                    "awslogs-group": "/ecs/prefetch",
                    "awslogs-region": "us-east-2",
                    "awslogs-stream-prefix": "ecs"
                }
            },
            "entryPoint": null,
            "portMappings": [
                {
                    "hostPort": 80,
                    "protocol": "tcp",
                    "containerPort": 80
                }
            ],
            "command": null,
            "linuxParameters": null,
            "cpu": 0,
            "environment": [],
            "resourceRequirements": null,
            "ulimits": null,
            "dnsServers": null,
            "mountPoints": [
                {
                    "readOnly": null,
                    "containerPath": "/usr/share/nginx/html",
                    "sourceVolume": "efs-html"
                }
            ],
            "workingDirectory": null,
            "secrets": null,
            "dockerSecurityOptions": null,
            "memory": 128,
            "memoryReservation": null,
            "volumesFrom": [],
            "stopTimeout": null,
            "image": "nginx",
            "startTimeout": null,
            "firelensConfiguration": null,
            "dependsOn": null,
            "disableNetworking": null,
            "interactive": null,
            "healthCheck": null,
            "essential": true,
            "links": null,
            "hostname": null,
            "extraHosts": null,
            "pseudoTerminal": null,
            "user": null,
            "readonlyRootFilesystem": null,
            "dockerLabels": null,
            "systemControls": null,
            "privileged": null,
            "name": "nginx"
        }
    ],
    "memory": "512",
    "taskRoleArn": null,
    "family": "efs-tutorial",
    "pidMode": null,
    "requiresCompatibilities": [
        "FARGATE"
    ],
    "networkMode": "awsvpc",
    "runtimePlatform": {
        "operatingSystemFamily": "LINUX",
        "cpuArchitecture": null
    },
    "cpu": "256",
    "inferenceAccelerators": [],
    "proxyConfiguration": null,
    "volumes": [
        {
            "fsxWindowsFileServerVolumeConfiguration": null,
            "efsVolumeConfiguration": {
                "transitEncryptionPort": null,
                "fileSystemId": "fs-0d15c1e9184fffacd",
                "authorizationConfig": {
                    "iam": "DISABLED",
                    "accessPointId": "fsap-04a23206444492e37"
                },
                "transitEncryption": "ENABLED",
                "rootDirectory": "/"
            },
            "name": "efs-html",
            "host": null,
            "dockerVolumeConfiguration": null
        }
    ],
    "tags": []
}

任务执行角色关联策略 #

策略1 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "*"
        }
    ]
}

策略2 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "cloudwatch:DescribeAlarmsForMetric",
                "cloudwatch:GetMetricData",
                "ec2:CreateNetworkInterface",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeNetworkInterfaceAttribute",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcs",
                "ec2:ModifyNetworkInterfaceAttribute",
                "elasticfilesystem:Backup",
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:CreateFileSystem",
                "elasticfilesystem:ClientMount",
                "elasticfilesystem:CreateMountTarget",
                "elasticfilesystem:CreateTags",
                "elasticfilesystem:CreateAccessPoint",
                "elasticfilesystem:CreateReplicationConfiguration",
                "elasticfilesystem:DeleteFileSystem",
                "elasticfilesystem:DeleteMountTarget",
                "elasticfilesystem:DeleteTags",
                "elasticfilesystem:DeleteAccessPoint",
                "elasticfilesystem:DeleteFileSystemPolicy",
                "elasticfilesystem:DeleteReplicationConfiguration",
                "elasticfilesystem:DescribeAccountPreferences",
                "elasticfilesystem:DescribeBackupPolicy",
                "elasticfilesystem:DescribeFileSystems",
                "elasticfilesystem:DescribeFileSystemPolicy",
                "elasticfilesystem:DescribeLifecycleConfiguration",
                "elasticfilesystem:DescribeMountTargets",
                "elasticfilesystem:DescribeMountTargetSecurityGroups",
                "elasticfilesystem:DescribeReplicationConfigurations",
                "elasticfilesystem:DescribeTags",
                "elasticfilesystem:DescribeAccessPoints",
                "elasticfilesystem:ModifyMountTargetSecurityGroups",
                "elasticfilesystem:PutAccountPreferences",
                "elasticfilesystem:PutBackupPolicy",
                "elasticfilesystem:PutLifecycleConfiguration",
                "elasticfilesystem:PutFileSystemPolicy",
                "elasticfilesystem:UpdateFileSystem",
                "elasticfilesystem:TagResource",
                "elasticfilesystem:UntagResource",
                "elasticfilesystem:ListTagsForResource",
                "elasticfilesystem:Restore",
                "kms:DescribeKey",
                "kms:ListAliases"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "iam:CreateServiceLinkedRole",
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": [
                        "elasticfilesystem.amazonaws.com"
                    ]
                }
            }
        }
    ]
}

排查方向与解决方案 #

1. EFS访问点配置问题 #

因为任务定义中使用了accessPointId且iam: DISABLED，访问权限由POSIX权限控制：

• 检查访问点的RootDirectory设置：如果指定了子路径，确保该路径已在EFS中存在，且权限允许Fargate任务的用户访问（nginx容器默认使用UID/GID为101的nginx用户）
• 临时移除accessPointId，直接挂载EFS根目录测试。如果挂载成功，说明问题出在访问点配置，需调整访问点的POSIX权限或路径设置

2. 挂载目标与Fargate子网的AZ一致性 #

Fargate任务只能挂载同一可用区（AZ）内的EFS挂载目标：

• 确认EFS在Fargate任务部署的每个子网对应的AZ都创建了挂载目标
• 检查Fargate任务的子网是否与EFS挂载目标属于同一VPC

3. EFS文件系统策略限制 #

文件系统策略可能阻止了Fargate任务的访问：

• 登录AWS控制台，查看EFS文件系统的策略，确保包含允许elasticfilesystem:ClientMount操作的语句，允许来自任务所在VPC CIDR的访问
• 若策略存在拒绝规则，需调整或移除相关限制

4. 安全组配置验证 #

• 确认EFS挂载目标关联的是配置中的EFS安全组，避免选错安全组导致端口未开放
• 检查Fargate任务的安全组ID是否正确添加到EFS安全组的入站规则中，确保TCP 2049端口允许容器安全组访问

5. 任务执行角色权限验证 #

虽然现有策略已包含EFS相关权限，但可确认elasticfilesystem:DescribeAccessPoints和elasticfilesystem:ClientMount权限已被允许（当前策略已覆盖，此步为验证）

内容的提问来源于stack exchange，提问作者jlo-gmail