How can I use Amazon EFS integration to troubleshoot Lambda function invoke issues?

Short description

The following configurations are required when you mount Amazon EFS access points with Lambda:

• The Lambda function's execution role must have the following elasticfilesystem permissions:
  elasticfilesystem:ClientMount
  elasticfilesystem:ClientWrite

  Note: elasticfilesystem:ClientWrite isn't required for read-only connections.

• Your AWS Identify and Access Management (IAM) user must have the elasticfilesystem:DescribeMountTargets permission.

• The EFS File System security group must allow NFS inbound traffic from the Lambda security group or IP address range.

• The Lambda security group must allow NFS outbound traffic to the EFS security group or IP address range.

• The Lambda function and Amazon EFS access points must be in the same AWS Region and Availability Zone.

• You must define the local mount path when you mount the EFS to Lambda.
  Note: The local mount path must start with "/mnt/".

For more information, see How do I use a Lambda function to create the correct Amazon EFS access point configuration to mount my file system?

Resolution

To troubleshoot this Lambda function error, take the following actions.

EFSMountFailureException

The Lambda function couldn't mount the configured EFS file system because of a permission or configuration issue. Check the Lambda functions permissions. Then, confirm that the EFS file system and access point exist and are ready for use.

EFSMountConnectivityException

The Lambda function couldn't use the NFS protocol to make a network connection to the configured EFS file system. Check the security group and routing configuration for the Amazon Virtual Private Cloud (Amazon VPC) subnets.

EFSMountTimeoutException

The Lambda function made the network connection to the configured EFS file system, but the mount operation timed out. Invoke the Lambda function again. If the Lambda function times out again, then limit the functions reserved concurrency to reduce the load volume on the EFS file system.

PermissionError: Permission denied: '/mnt/xyz/abc'

Lambda can't access the specified Amazon EFS access point. To troubleshoot Amazon EFS access points, see What are common EFS access point configurations?

Related information

Troubleshoot invocation issues in Lambda

Working with Amazon EFS access points