EBS, EFS and instance store

The storage decision

Start with the access pattern, not the product name.

• EBS is a persistent block device for one Availability Zone. A running EC2 instance can format and mount it like a disk.
• EFS is a regional NFS file system. Multiple instances can mount it at the same time when the network path and permissions are correct.
• Instance store is local scratch storage on the host. It is fast, but it is temporary.

The root EBS volume and an attached data volume are separate resources. A snapshot is separate again. Deleting the instance does not automatically mean every independently created volume or snapshot is gone.

⤢ View

(1) The temporary instance is a t3.micro. Its Availability Zone matters because EBS volumes are zonal.© Screenshot: DevOps Academy

Close

EBS volume types

gp3 is the normal starting point. It gives a general-purpose SSD baseline and lets you set IOPS and throughput independently. Use io2 when the workload needs higher durability and sustained provisioned IOPS. st1 is throughput-oriented HDD storage for large sequential workloads. sc1 is the lowest-cost HDD option for infrequently accessed sequential data.

Do not choose st1 or sc1 for a database. Do not choose io2 just because it sounds more enterprise. Measure latency, IOPS, throughput and the recovery requirement first.

The temporary lesson volume was a 1 GiB encrypted gp3 volume:

{
    "VolumeId": "vol-0bae53dac6ff74161",
    "State": "creating",
    "Size": 1,
    "Type": "gp3",
    "Encrypted": true,
    "AZ": "ap-south-1b"
}

⤢ View

(1) The lesson volume is gp3, 1 GiB and encrypted. The volume and instance must share an Availability Zone before attachment.© Screenshot: DevOps Academy

Close

Snapshots

An EBS snapshot is incremental after the first snapshot and is stored independently of the source volume. It is a recovery building block, not a complete backup policy. Test restoring a volume, protect snapshot permissions and define retention.

The captured snapshot was encrypted, linked to the 1 GiB volume and completed with no data blocks:

{
    "SnapshotId": "snap-0ffc0b305cb37c638",
    "State": "pending",
    "Encrypted": true,
    "VolumeId": "vol-0bae53dac6ff74161",
    "Size": 1
}

⤢ View

(1) The snapshot row identifies the source volume and its one GiB size. Wait for completed before treating it as a recovery point.© Screenshot: DevOps Academy

Close

Encryption

The lesson volume and snapshot used encryption at rest. With the default EBS encryption setting, AWS uses the account's configured KMS key. For a production system, decide who can use the key, who can create snapshots and who can copy them to another Region.

Encryption does not grant access. IAM, KMS key policy, snapshot sharing and the instance's operating-system permissions still matter.

EFS: a shared file system

EFS is regional, but clients connect through mount targets in VPC subnets. The file system can exist without a mount target, as it did in this lesson:

{
    "FileSystemId": "fs-0ef4ae49937fb9368",
    "State": "creating",
    "Encrypted": true,
    "PerformanceMode": "generalPurpose",
    "ThroughputMode": "bursting",
    "MountTargets": 0
}

Create mount targets in the subnets where clients run, use security groups that allow NFS over TCP 2049, and mount with the recommended EFS helper. Mount targets are network resources with their own cost and should not be created casually in a teaching exercise.

⤢ View

(1) The file system is encrypted and empty. It has no mount target because the lesson does not need a client network path.© Screenshot: DevOps Academy

Close

Instance store: temporary by design

Some EC2 instance types include local NVMe instance store devices. The data is tied to that host. A stop, hibernate or termination can make it unavailable, depending on the instance type and event. Use it for caches, scratch space and temporary processing. Keep the source data somewhere durable.

Tune gp3 for the workload

gp3 separates capacity from performance. Start with its included baseline, then raise IOPS or throughput only when measurements show the workload needs it. io2 is the higher-durability, provisioned-IOPS choice; gp3 is usually the better general-purpose default. Changing gp3 performance is online, but the modification progresses asynchronously, so check its state before declaring the change complete.

$ aws ec2 modify-volume --volume-id "$VOLUME_ID" --iops 6000 --throughput 250
$ aws ec2 describe-volumes-modifications --volume-ids "$VOLUME_ID" \
  --query 'VolumesModifications[].{State:ModificationState,Progress:Progress,IOPS:TargetIops,Throughput:TargetThroughput}' --output table

FSx is a specialised file system

EFS is a regional, elastic NFS file system. FSx is the managed choice when the application expects a particular file protocol or storage engine: Windows File Server for SMB, Lustre for high-throughput compute, NetApp ONTAP for enterprise NAS features, and OpenZFS for ZFS semantics. Choose FSx for that compatibility; do not add it just because a block volume is full.

DLM automates snapshot retention

An EBS snapshot is a point-in-time recovery object. Data Lifecycle Manager (DLM) applies a tag-based schedule so new volumes get snapshots without a hand-written cron job. It is useful for fleet-wide retention, while AWS Backup is the broader policy and cross-service recovery tool. Tag the volume, test a restore, and set retention before enabling a production policy.

$ aws dlm get-lifecycle-policies --state ENABLED --region ap-south-1 \
  --query 'Policies[].{Id:PolicyId,Description:Description,State:State}' --output table

AWS Backup

AWS Backup centralizes backup plans, schedules, retention and recovery-point management across supported services. It is useful when a team needs policy and audit controls across accounts and Regions. A hand-created EBS snapshot is still useful for a one-off test, but it does not provide those governance controls by itself.

$ export AWS_REGION=ap-south-1
$ export AMI_ID="$(aws ec2 describe-images --owners amazon \
    --filters 'Name=name,Values=al2023-ami-2023.*-x86_64' 'Name=state,Values=available' \
    --query 'sort_by(Images,&CreationDate)[-1].ImageId' --output text)"
$ export INSTANCE_ID="$(aws ec2 run-instances --region "$AWS_REGION" --image-id "$AMI_ID" \
    --instance-type t3.micro --count 1 \
    --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=storage-types-mission}]' \
    --query 'Instances[0].InstanceId' --output text)"
$ export AZ="$(aws ec2 describe-instances --region "$AWS_REGION" --instance-ids "$INSTANCE_ID" \
    --query 'Reservations[0].Instances[0].Placement.AvailabilityZone' --output text)"
$ export VOLUME_ID="$(aws ec2 create-volume --region "$AWS_REGION" --availability-zone "$AZ" \
    --size 1 --volume-type gp3 --encrypted \
    --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=storage-types-volume}]' \
    --query VolumeId --output text)"
$ aws ec2 wait volume-available --region "$AWS_REGION" --volume-ids "$VOLUME_ID"
$ export SNAPSHOT_ID="$(aws ec2 create-snapshot --region "$AWS_REGION" --volume-id "$VOLUME_ID" \
    --description storage-types-mission --query SnapshotId --output text)"
$ export FILE_SYSTEM_ID="$(aws efs create-file-system --region "$AWS_REGION" --encrypted \
    --performance-mode generalPurpose --throughput-mode bursting \
    --tags Key=Name,Value=storage-types-efs --query FileSystemId --output text)"
$ aws ec2 describe-volumes --region "$AWS_REGION" --volume-ids "$VOLUME_ID" \
    --query 'Volumes[0].{State:State,Type:VolumeType,Size:Size,Encrypted:Encrypted,AZ:AvailabilityZone}' --output table
---------------------------------------------
|              DescribeVolumes               |
+------------+------+-------+---------+------+
| Encrypted  | Size | State | Type    |  AZ  |
+------------+------+-------+---------+------+
|  True      |  1   | avail | gp3     |  AZ  |
+------------+------+-------+---------+------+
$ aws ec2 delete-snapshot --region "$AWS_REGION" --snapshot-id "$SNAPSHOT_ID"
$ aws ec2 delete-volume --region "$AWS_REGION" --volume-id "$VOLUME_ID"
$ aws efs delete-file-system --region "$AWS_REGION" --file-system-id "$FILE_SYSTEM_ID"
$ aws ec2 terminate-instances --region "$AWS_REGION" --instance-ids "$INSTANCE_ID"
$ aws ec2 wait instance-terminated --region "$AWS_REGION" --instance-ids "$INSTANCE_ID"
$ aws ec2 describe-volumes --region "$AWS_REGION" --volume-ids "$VOLUME_ID"
An error occurred (InvalidVolume.NotFound) when calling the DescribeVolumes operation
$ aws ec2 describe-snapshots --region "$AWS_REGION" --snapshot-ids "$SNAPSHOT_ID"
An error occurred (InvalidSnapshot.NotFound) when calling the DescribeSnapshots operation
$ aws efs describe-file-systems --region "$AWS_REGION" --file-system-id "$FILE_SYSTEM_ID"
An error occurred (FileSystemNotFound) when calling the DescribeFileSystems operation