aws-efs-csi-driver: Access Denied when using Access Points

@KarstenSiemer EFS Encryption document provides more information into how encryption works for EFS.

While the KMS key that you created will be used by EFS to encrypt/decrypt data at rest, encryption in transit is handled by tls tunnel created by efs-utils on behalf of the driver while mounting and this does not require KMS.

I gave this a try and it works perfectly! Thanks @kbasv and the “workaround” with the tags is actually quite clever 😉

However I did change StringLike to StringEquals 😉

https://github.com/kubernetes-sigs/aws-efs-csi-driver/blob/4a8153ecbfa12afeb1a62e0aab4aab016d5804c2/docs/iam-policy-example.json#L19

My terraform resource now looks like this if anyone is curious

data "aws_iam_policy_document" "efs_csi" {
  statement {
    actions = [
      "elasticfilesystem:DescribeFileSystems",
    ]
    resources = [aws_efs_file_system.csi.arn]
  }

  statement {
    actions = [
      "elasticfilesystem:DescribeAccessPoints",
    ]
    resources = ["*"]
  }

  statement {
    actions = [
      "elasticfilesystem:CreateAccessPoint",
    ]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "aws:RequestTag/efs.csi.aws.com/cluster"
      values   = ["true"]
    }
  }

  statement {
    actions = [
      "elasticfilesystem:DeleteAccessPoint",
    ]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/efs.csi.aws.com/cluster"
      values   = ["true"]
    }
  }
}

I have deployed the driver into several clusters many of which are in the same aws account, so I have personally settled with this:

resource "aws_iam_policy" "aws_efs_csi_driver" {
  count  = var.aws_efs_csi_driver_enabled ? 1 : 0
  name   = "aws-efs-csi-driver-${var.name}"
  policy = <<-EOD
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "elasticfilesystem:DescribeAccessPoints",
          "elasticfilesystem:DescribeFileSystems"
        ],
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": [
          "elasticfilesystem:CreateAccessPoint"
        ],
        "Resource": "*",
        "Condition": {
          "StringLike": {
            "aws:RequestTag/efs.csi.aws.com/cluster": "true",
            "aws:RequestTag/cluster-name": "${var.name}"
          }
        }
      },
      {
        "Effect": "Allow",
        "Action": "elasticfilesystem:DeleteAccessPoint",
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "aws:ResourceTag/efs.csi.aws.com/cluster": "true",
            "aws:ResourceTag/cluster-name": "${var.name}"
          }
        }
      }
    ]
  }
  EOD
}

I have added the cluster-name tag into the drivers deployment by specifying the --tags=cluster-name:name flag like that. Now they cannot interfere with other clusters access points. This works very well, I am quite pleased. Anyhow this is all I needed and did not need to specify any rules among ClientRootAccess or something like that

Mh weird. It didn’t seem like to work properly all the time with my policy above. The log didn’t really helped me but after re-adding this part it seems to work fine again:

  statement {
    actions = [
      "elasticfilesystem:ClientRootAccess",
      "elasticfilesystem:ClientWrite",
      "elasticfilesystem:ClientMount",
    ]
    resources = [aws_efs_file_system.csi.arn]
    condition {
      test     = "Bool"
      variable = "elasticfilesystem:AccessedViaMountTarget"
      values   = ["true"]
    }
  }

Is that expected?

Edit: Maybe something weird happend when updating the csi driver and then changing the permissions multiple times without re-deploying. I’m refreshing all nodes now and that should probably fix the flaky csi driver. Not sure if I change the policy again. If it works now I’ll not touch it again 😄

@Skaronator PR 309 allows adding tags to your access points. You can modify the policy described in this example to add additional tags. These tags can be passed in as additional tags from cmd line option tags. The driver appends these tags when it creates access points.

The above tags can be used as a mechanism to limit the driver to access points created by driver.