EFS mount targets should not be associated with subnets that assign public IP addresses on launch

How to fix it

• Replaces the resource: A mount target's subnet cannot change and each Availability Zone holds one, so remove the old mount target and save, then add one in the private subnet.
• Interrupts service: Removing a mount target forcibly breaks every mount through it, so stop applications and unmount on clients in that Availability Zone first.

In the console

EFS → File systems → the file system → Network → Manage

Subnet ID

A subnet in the same Availability Zone with auto-assign public IPv4 and IPv6 addresses off

Security groups

The ones the old mount target used

With the AWS CLI

aws efs create-mount-target --file-system-id <file-system-id> --subnet-id <private-subnet-id> --security-groups <security-group-id> --region <region>

With Terraform

resource "aws_efs_mount_target" "this" {
  file_system_id  = var.file_system_id
  subnet_id       = var.private_subnet_id
  security_groups = var.security_group_ids
}