EFS access points should enforce a root directory

How to fix it

• Replaces the resource: An access point cannot be modified: create a new one with this root directory, change each client's accesspoint mount option to its ID, then delete this one.
• Can break clients: Clients of the new access point see its root directory as /, so files outside it are out of reach and paths the application used may change.
• Affects another check: EFS.4 judges the new access point too and a POSIX user cannot be added later, so give it this one's User ID and Group ID, or the ones it should enforce.

In the console

EFS → Access points → Create access point

File system

The file system this access point serves

Root directory path

A subdirectory such as /app; / fails

Root directory creation permissions

Owner user ID, Owner group ID and Permissions such as 755, or a missing path is not created and mounts fail

With the AWS CLI

aws efs create-access-point --client-token <unique-token> --file-system-id <file-system-id> --root-directory 'Path=/app,CreationInfo={OwnerUid=<owner-uid>,OwnerGid=<owner-gid>,Permissions=755}' --region <region>

With Terraform

resource "aws_efs_access_point" "this" {
  file_system_id = var.file_system_id

  root_directory {
    path = "/app"

    creation_info {
      owner_gid   = 1000
      owner_uid   = 1000
      permissions = "755"
    }
  }
}