Mount Amazon EFS from different VPC through VPC Peering

3
votes

I'm searching for a way to synchronize EFS contents over two different EBS cluster. The plan is to mount both EFS into a EC2 instance during deployment to rsync the contents afterwards.

Our Setup:

  • 2 ELB Cluster
  • each in an own VPC with 3 availability zones
  • one is our stage/maintenance cluster, where our customer uploads media data and creates CMS-pages etc. and one for production purpose
  • each of the ELB's uses an EFS to store User generated content, such uploaded images etc.

The goal:

  • synchronize EFS1 to EFS2 during deployments
  • therefore both EFS should be mounted in one of the LIVE clusters EC2 instances
  • this way the contents could be synchronized from one mountpoint to the other one using rsync

Current status:

  • ELB and EFS working great for each of the two domains (stage / live) we peeres the VPCs successfully with DNS resolution in both directions
  • I added the complete STAGE CIDR as a route to the VPC-Peering for LIVE
  • I allowed the access to the STAGE EFS for the live webserver security group in the EFS security group for STAGE EFS.
  • I can ping the EC2 instances of the STAGE EBS from a EC2 instance of the LIVE EBS via DNS-name

The problem is, that I can't mount the STAGE EFS inside of my LIVE EC2s. In contrast to the EC2 DNS names, the hostname cannot be resolved (mount.nfs4: Failed to resolve server eu-west-1b.fs-123456.efs.eu-west-1.amazonaws.com: Name or service not known)

Can someone tell me, what's wrong with my setup/strategy or at least point me to the right direction and tell me if it is solvable this way or not?

Thanks a lot!!!

2
amazon-web-servicesamazon-ec2amazon-elastic-beanstalkamazon-vpcefs
I haven't tried this before, but I'm also interested in whether it can work. What instance types are you using? According to this, VPC peering supports EFS mounts on C5 or M5 instances - but I'm not sure why only these types, and whether this manifests as DNS not resolving.. or just the mount failing; there's a lack of info in that documentation. So maybe... resize your instance and give it a go? – Tim Malone
Also you've mentioned an 'EBS cluster' (Elastic Block Store).. then an 'ELB cluster' (Elastic Load Balancer), and you've tagged elastic-beanstalk. Might be worth clarifying? – Tim Malone

2 Answers

2
votes

efs mount from the same account but different VPC, having VPC peering done, but you can mount by using only the private IP address. not by using dns-name, even if you enable dns resolution over vpc peering also it won't work.

-3
votes

Unfortunately Amazon does not allow you to use EFS instances from another VPC. No way, not with the dns or pointing to the IP. I hope it will help you and in time you can look for an alternative.

Please read: https://docs.aws.amazon.com/efs/latest/ug/limits.html#limits-additional-considerations