Mount Targets

Progress checklist

• Subnet IDs identified per AZ
• Mount target security group created
• Mount target created in each AZ
• All mount targets in available state

Overview

A MOUNT-TARGET MOUNT-TARGET
Mount Target — a network endpoint that provides NFS access to an S3 file system within a single Availability Zone. One mount target per AZ is recommended. gives compute resources a network path to the file system within a single AZ AZ
Availability Zone — an isolated data-centre location within an AWS region. Mount targets are created per AZ for high availability. . Create one per AZ where your EC2 instances run — you can have at most one per AZ.

Note

On EC2 — Launch & install, the instance subnet can differ from SUBNET_ID_AZA here as long as it stays in the same Availability Zone — that lets Session Manager use a subnet with internet egress while mount targets remain on private subnets.

1. Confirm base exports. Required

   Re-run these in your current shell so all required variables are set:

   export AWS_REGION=ap-southeast-6
   export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
   export BUCKET=my-s3-files-bucket        # ← replace with your real bucket name
   export BUCKET_ARN=arn:aws:s3:::${BUCKET}
   export FS_ID=$(aws s3files list-file-systems \
     --region $AWS_REGION \
     --bucket $BUCKET_ARN \
     --query 'fileSystems[0].fileSystemId' \
     --output text)
   echo "Region: $AWS_REGION  Account: $ACCOUNT_ID  FS: $FS_ID"

   If FS_ID is empty or None, complete File System first.

2. List your VPC subnets and identify one per AZ.

   export VPC_ID=vpc-0123456789abcdef0   # replace with your VPC ID
   
   aws ec2 describe-subnets \
     --filters "Name=vpc-id,Values=$VPC_ID" \
     --query 'Subnets[*].{AZ:AvailabilityZone,SubnetId:SubnetId,CIDR:CidrBlock}' \
     --output table \
     --region $AWS_REGION

   Note a subnet ID for each AZ you need. Pick the private subnets where your EC2 instances will run.

3. Create a security group for mount targets. Required

   export MT_SG_ID=$(aws ec2 create-security-group \
     --group-name s3files-mount-target-sg \
     --description "S3 Files mount target - NFS inbound" \
     --vpc-id $VPC_ID \
     --region $AWS_REGION \
     --query GroupId \
     --output text)
   echo "Mount target SG: $MT_SG_ID"

   Note

   The inbound NFS rule (port 2049) is added in the Security Groups step after you know the compute security group ID.

4. Create a mount target in each AZ. Required

   From the step 2 table, copy one subnet ID per Availability Zone where you need NFS. Assign each to a shell variable before calling create-mount-target.

   First AZ (required): set a real subnet ID. Match the AZ column from step 2 in the comment:

   export SUBNET_ID_AZA=subnet-0123456789abcdef0   # replace — e.g. private subnet in ap-southeast-6a

   Second AZ (required if your VPC has a second AZ and you want HA):

   export SUBNET_ID_AZB=subnet-0fedcba9876543210   # replace — e.g. private subnet in ap-southeast-6b

   Add another export SUBNET_ID_AZC=subnet-… for each extra AZ — do not run create-mount-target with placeholder subnet IDs.

   Note

   Bash treats SUBNET_ID_AZA and SUBNET_ID_AZa as different variables. Use all-uppercase AZA / AZB / AZC in both export and $SUBNET_ID_… references, or --subnet-id can end up empty and the CLI returns expected one argument.

   Create one mount target per export (at most one mount target per AZ):

   aws s3files create-mount-target \
     --region $AWS_REGION \
     --file-system-id $FS_ID \
     --subnet-id $SUBNET_ID_AZA \
     --security-groups $MT_SG_ID
   
   aws s3files create-mount-target \
     --region $AWS_REGION \
     --file-system-id $FS_ID \
     --subnet-id $SUBNET_ID_AZB \
     --security-groups $MT_SG_ID

   If you only use one AZ, keep the first export and the first create-mount-target only; skip SUBNET_ID_AZB and the second API call.

   Mount target creation takes up to 5 minutes per target.

5. Wait until all mount targets are available.

   aws s3files list-mount-targets \
     --region $AWS_REGION \
     --file-system-id $FS_ID \
     --query 'mountTargets[*].{AZ:availabilityZoneId,State:status,IP:ipv4Address}' \
     --output table

   Re-run until all entries show available in the State column.

Next step

Continue to IAM to create the EC2 compute role.