Block and File Storage on AWS

export AWS_REGION=us-east-1
export AZ=us-east-1a
export INSTANCE_ID=i-0123456789abcdef0   # placeholder

# Create an encrypted gp3 volume with the baseline IOPS and throughput
VOLUME_ID=$(aws ec2 create-volume --availability-zone "$AZ" --volume-type gp3 \
  --size 50 --iops 3000 --throughput 125 --encrypted \
  --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=bookshelf-catalog-data}]' \
  --query VolumeId --output text)
aws ec2 wait volume-available --volume-ids "$VOLUME_ID"

# Attach it to a running instance in the same Availability Zone
aws ec2 attach-volume --volume-id "$VOLUME_ID" --instance-id "$INSTANCE_ID" --device /dev/sdf

lsblk                                   # find the new, empty device
sudo mkfs -t xfs /dev/nvme1n1           # only for a new, empty volume
sudo mkdir -p /data
sudo mount /dev/nvme1n1 /data
sudo blkid /dev/nvme1n1                 # use the UUID in /etc/fstab with the nofail option

aws ec2 modify-volume --volume-id "$VOLUME_ID" --size 100 --iops 6000 --throughput 250
aws ec2 describe-volumes-modifications --volume-ids "$VOLUME_ID" \
  --query "VolumesModifications[].[ModificationState,Progress]" --output text
sudo xfs_growfs -d /data

# Turn on encryption by default for this Region and choose the key
aws ec2 enable-ebs-encryption-by-default
aws ec2 modify-ebs-default-kms-key-id --kms-key-id alias/bookshelf-ebs
aws ec2 get-ebs-encryption-by-default

# Encrypt an existing unencrypted volume: snapshot it, copy the snapshot encrypted, create the new volume
aws ec2 copy-snapshot --source-region "$AWS_REGION" --source-snapshot-id "$SNAPSHOT_ID" \
  --encrypted --kms-key-id alias/bookshelf-ebs --description "encrypted copy"

export AWS_REGION=us-east-1
export SUBNET_A=subnet-0aaaaaaaaaaaaaaaa      # placeholders, one per Availability Zone
export SUBNET_B=subnet-0bbbbbbbbbbbbbbbb
export SG_EFS=sg-0123456789abcdef0            # allows TCP 2049 from the client security groups

FS_ID=$(aws efs create-file-system --creation-token bookshelf-exports \
  --performance-mode generalPurpose --throughput-mode elastic --encrypted \
  --tags Key=Name,Value=bookshelf-exports --query FileSystemId --output text)
aws efs describe-file-systems --file-system-id "$FS_ID" --query "FileSystems[0].LifeCycleState"

# One mount target per Availability Zone
aws efs create-mount-target --file-system-id "$FS_ID" --subnet-id "$SUBNET_A" --security-groups "$SG_EFS"
aws efs create-mount-target --file-system-id "$FS_ID" --subnet-id "$SUBNET_B" --security-groups "$SG_EFS"

# Tier cold files to IA and Archive, and bring a file back to Standard on first access
aws efs put-lifecycle-configuration --file-system-id "$FS_ID" --lifecycle-policies \
  TransitionToIA=AFTER_30_DAYS TransitionToArchive=AFTER_90_DAYS TransitionToPrimaryStorageClass=AFTER_1_ACCESS

# Automatic backups with AWS Backup
aws efs put-backup-policy --file-system-id "$FS_ID" --backup-policy Status=ENABLED

# An access point that confines applications to /exports as POSIX user 1001
AP_ID=$(aws efs create-access-point --file-system-id "$FS_ID" \
  --posix-user Uid=1001,Gid=1001 \
  --root-directory 'Path=/exports,CreationInfo={OwnerUid=1001,OwnerGid=1001,Permissions=750}' \
  --tags Key=Name,Value=bookshelf-exports --query AccessPointId --output text)

Resources:
  ExportsFileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      Encrypted: true
      PerformanceMode: generalPurpose
      ThroughputMode: elastic
      BackupPolicy:
        Status: ENABLED
      LifecyclePolicies:
        - TransitionToIA: AFTER_30_DAYS
        - TransitionToArchive: AFTER_90_DAYS
      FileSystemTags:
        - Key: Name
          Value: bookshelf-exports
  ExportsMountTargetA:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref ExportsFileSystem
      SubnetId: !Ref SubnetA
      SecurityGroups: [!Ref EfsSecurityGroup]
  ExportsAccessPoint:
    Type: AWS::EFS::AccessPoint
    Properties:
      FileSystemId: !Ref ExportsFileSystem
      PosixUser:
        Uid: "1001"
        Gid: "1001"
      RootDirectory:
        Path: /exports
        CreationInfo:
          OwnerUid: "1001"
          OwnerGid: "1001"
          Permissions: "750"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowBookshelfRolesThroughTheAccessPointOnly",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::111122223333:role/bookshelf-orders-api-task",
          "arn:aws:iam::111122223333:role/bookshelf-thumbnailer"
        ]
      },
      "Action": [
        "elasticfilesystem:ClientMount",
        "elasticfilesystem:ClientWrite"
      ],
      "Condition": {
        "StringEquals": {
          "elasticfilesystem:AccessPointArn": "arn:aws:elasticfilesystem:us-east-1:111122223333:access-point/fsap-0123456789abcdef0"
        }
      }
    },
    {
      "Sid": "DenyUnencryptedTransport",
      "Effect": "Deny",
      "Principal": { "AWS": "*" },
      "Action": "*",
      "Condition": { "Bool": { "aws:SecureTransport": "false" } }
    }
  ]
}

sudo mkdir -p /mnt/exports
sudo mount -t efs -o tls,iam,accesspoint="$AP_ID" "$FS_ID":/ /mnt/exports
# /etc/fstab
# fs-0123456789abcdef0:/ /mnt/exports efs _netdev,noresvport,tls,iam,accesspoint=fsap-0123456789abcdef0 0 0

{
  "volumes": [
    {
      "name": "exports",
      "efsVolumeConfiguration": {
        "fileSystemId": "fs-0123456789abcdef0",
        "transitEncryption": "ENABLED",
        "authorizationConfig": { "accessPointId": "fsap-0123456789abcdef0", "iam": "ENABLED" }
      }
    }
  ],
  "containerDefinitions": [
    {
      "name": "orders-api",
      "mountPoints": [ { "sourceVolume": "exports", "containerPath": "/exports" } ]
    }
  ]
}

aws lambda update-function-configuration --function-name thumbnailer \
  --file-system-configs "Arn=arn:aws:elasticfilesystem:us-east-1:111122223333:access-point/fsap-0123456789abcdef0,LocalMountPath=/mnt/exports"

aws eks create-addon --cluster-name bookshelf-eks --addon-name aws-efs-csi-driver
aws eks create-addon --cluster-name bookshelf-eks --addon-name aws-ebs-csi-driver

package com.example.bookshelf.orders;

import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.StandardCopyOption;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

@Component
public class ExportWriter {

    private final Path exportDir;

    public ExportWriter(@Value("${bookshelf.exports.dir:/exports}") Path exportDir) {
        this.exportDir = exportDir;
    }

    /** Writes atomically: readers on other clients never see a half-written file. */
    public Path write(String name, String csv) throws IOException {
        Path tmp = Files.createTempFile(exportDir, name, ".tmp");
        Files.writeString(tmp, csv, StandardCharsets.UTF_8);
        return Files.move(tmp, exportDir.resolve(name), StandardCopyOption.ATOMIC_MOVE);
    }
}

aws backup create-backup-vault --backup-vault-name bookshelf-vault
aws backup create-backup-vault --backup-vault-name bookshelf-vault-dr --region us-west-2

cat > backup-plan.json <<'JSON'
{
  "BackupPlanName": "bookshelf-daily",
  "Rules": [
    {
      "RuleName": "daily-35d-with-dr-copy",
      "TargetBackupVaultName": "bookshelf-vault",
      "ScheduleExpression": "cron(0 5 * * ? *)",
      "StartWindowMinutes": 60,
      "CompletionWindowMinutes": 360,
      "Lifecycle": { "DeleteAfterDays": 35 },
      "CopyActions": [
        {
          "DestinationBackupVaultArn": "arn:aws:backup:us-west-2:111122223333:backup-vault:bookshelf-vault-dr",
          "Lifecycle": { "DeleteAfterDays": 90 }
        }
      ]
    }
  ]
}
JSON
PLAN_ID=$(aws backup create-backup-plan --backup-plan file://backup-plan.json \
  --query BackupPlanId --output text)

aws backup create-backup-selection --backup-plan-id "$PLAN_ID" --backup-selection '{
  "SelectionName": "tagged-daily",
  "IamRoleArn": "arn:aws:iam::111122223333:role/service-role/AWSBackupDefaultServiceRole",
  "ListOfTags": [ { "ConditionType": "STRINGEQUALS", "ConditionKey": "backup", "ConditionValue": "daily" } ]
}'