Which Ports and Security Groups Are Needed to Mount Amazon EFS?

To allow an Amazon EC2 instance to mount an Amazon Elastic File System via the Network File System protocol, you must open TCP port 2049. Specifically, the security group attached to your EFS mount targets requires an inbound rule permitting TCP traffic on port 2049 from the EC2 instance security group or CIDR block, while the EC2 instance security group must allow outbound traffic on TCP port 2049 to the EFS mount target.

Required Network Port for Amazon EFS

Amazon EFS uses the Network File System version 4 (NFSv4.0 and NFSv4.1) protocol for file system access. Unlike older versions of NFS that required multiple ports for portmapper and mount daemons (such as port 111), NFSv4 consolidates all communication over a single standard port:

  • Protocol: TCP
  • Port Range: 2049
  • Service Name: NFS

Even when you encrypt data in transit using the Amazon EFS mount helper (amazon-efs-utils), the underlying TLS wrapper still routes traffic to the EFS mount target over TCP port 2049.

Security Group Rules Configuration

To establish a clean, least-privilege connection between your compute instances and the file system, you should use two separate security groups: one associated with your EC2 instances and another associated with your EFS mount targets. Referencing security group IDs rather than static IP addresses ensures that access scales automatically as instances are launched or terminated.

1. EFS Mount Target Security Group

Each EFS mount target placed in a VPC subnet has an associated security group. This security group controls what traffic is allowed to reach the file system.

Inbound Rules:

  • Type: NFS
  • Protocol: TCP
  • Port Range: 2049
  • Source: The Security Group ID of your EC2 instances (for example, sg-0123456789abcdef0) or the specific VPC CIDR block if mounting across peered VPCs or AWS Transit Gateway.

Outbound Rules:

  • No additional outbound rules are required to respond to EC2 requests because AWS security groups are stateful. Any traffic permitted inbound on port 2049 will automatically have its return traffic permitted back to the requesting EC2 instance.

2. EC2 Instance Security Group

The security group attached to your EC2 instance controls the traffic leaving the instance toward the EFS mount target.

Outbound Rules:

  • Type: NFS
  • Protocol: TCP
  • Port Range: 2049
  • Destination: The Security Group ID of your EFS mount target (for example, sg-0fedcba9876543210). Note that default AWS security groups already allow all outbound traffic (0.0.0.0/0 on all ports), which satisfies this requirement if left unmodified.

Inbound Rules:

  • Because security groups are stateful, no inbound rule on port 2049 is required on the EC2 instance security group for standard EFS mounting.

Network ACL and DNS Considerations

While security groups are the primary firewall mechanism at the instance and mount target interface level, subnet-level Network Access Control Lists (NACLs) and VPC DNS settings can also affect your ability to mount an EFS file system.

Subnet Network ACLs

Unlike security groups, Network ACLs are stateless. If your EC2 instance and EFS mount target reside in different subnets—or if you use custom NACLs instead of the default permissive NACL—you must explicitly allow both the request on port 2049 and the return traffic on ephemeral ports:

  • EC2 Subnet NACL: Allow outbound TCP port 2049 to the EFS mount target subnet CIDR, and allow inbound TCP traffic on ephemeral ports (\(1024 \text{ to } 65535\)) from the EFS mount target subnet CIDR.
  • EFS Mount Target Subnet NACL: Allow inbound TCP port 2049 from the EC2 subnet CIDR, and allow outbound TCP traffic on ephemeral ports (\(1024 \text{ to } 65535\)) to the EC2 subnet CIDR.

VPC DNS Resolution

When mounting an EFS file system by its DNS name (recommended) or using the amazon-efs-utils mount helper, your EC2 instance needs to resolve the EFS DNS hostname (file-system-id.efs.aws-region.amazonaws.com) to the mount target's private IP address. Ensure the following settings are enabled on your VPC:

  • enableDnsHostnames set to true
  • enableDnsSupport set to true

The EC2 instance must also be able to reach the Amazon Route 53 Resolver (located at the VPC base CIDR plus two, or 169.254.169.253) over UDP and TCP port 53.

Verifying Connectivity Before Mounting

Before running the mount command on your EC2 instance, you can test whether the security group rules and network path to port 2049 are properly configured using nc (netcat) or telnet:

nc -zv fs-0123456789abcdef0.efs.us-east-1.amazonaws.com 2049

If the security groups and NACLs are configured properly, the command immediately returns a connection succeeded message. If the connection times out, verify that the EFS mount target exists in the same Availability Zone as the EC2 instance and that the EFS security group inbound rule references the exact security group attached to your EC2 instance.