Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 244 discussion

B: The EFS file system’s security group must allow inbound traffic on the NFS port (2049) from the EC2 instances in the EKS cluster. Without this rule, the EC2 instances won't be able to communicate with the EFS file system. C: The EFS CSI driver needs permissions to interact with the EFS file system. This involves creating an IAM role with the necessary permissions and associating it with the EFS CSI driver. E: EFS requires a mount target in each subnet where the EC2 instances reside. This mount target facilitates the network connectivity between the EFS file system and the EC2 instances.

---> B C E

B. EFS file system’s security group must allow inbound NFS traffic (typically on port 2049) from the security group or IP range of the EKS cluster nodes. C. Ensure that the EFS CSI driver has the necessary IAM permissions to interact with the EFS file system, such as "elasticfilesystem:DescribeFileSystems", "elasticfilesystem:DescribeMountTargets", and other relevant permissions.

So, the correct solutions are: B. Add an inbound rule to the EFS file system’s security group to allow NFS traffic from the EKS cluster. C. Create an IAM role that allows the Amazon EFS CSI driver to interact with the file system. E. Create a mount target for the EFS file system in the subnet of the EKS nodes.