EFS access points should enforce a user identity

How to fix it

• Replaces the resource: An access point cannot be modified: create a new one with this POSIX user, change each client's accesspoint mount option to its ID, then delete this one.
• Can break clients: Every request through the new access point runs as this user and group, whatever IDs the client sends, so files clients could reach before may become unreadable or unwritable.
• Affects another check: EFS.3 judges the new access point too and its root directory cannot change later, so use a path other than / now if it should enforce one.

In the console

EFS → Access points → Create access point

User ID

The numeric POSIX user ID the application acts as; 0 (root) also needs the ClientRootAccess permission

Group ID

The numeric POSIX group ID for that user

Secondary group IDs

Optional; any further groups it needs

Root directory path

The same as this access point's, so clients keep seeing the same files

With the AWS CLI

aws efs create-access-point --client-token <unique-token> --file-system-id <file-system-id> --posix-user Uid=<uid>,Gid=<gid> --root-directory Path=<root-directory-path> --region <region>

With Terraform

resource "aws_efs_access_point" "this" {
  file_system_id = var.file_system_id

  posix_user {
    gid = 1000
    uid = 1000
  }

  root_directory {
    path = var.root_directory_path
  }
}