# How to Use AWS Storage Services Effectively (S3, EBS, EFS)

> Effectively use AWS storage services like S3 EBS and EFS. Learn best practices for object block and file storage with lifecycle policies encryption and shared file systems powered by the Agent Toolkit for AWS.

- Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws)
- Tags: how-to-guide
- Published: 2026-06-26

---

**Use Amazon S3 for scalable object storage with lifecycle policies and TLS enforcement, Amazon EBS for persistent encrypted block storage using gp3 volumes, and Amazon EFS for shared POSIX-compliant file systems with elastic throughput, following the security and provisioning patterns codified in the Agent Toolkit for AWS.**

The `aws/agent-toolkit-for-aws` repository provides production-ready skills that encapsulate best practices for provisioning, securing, and troubleshooting AWS storage services. This guide extracts concrete implementation patterns directly from the toolkit's source code to help you architect durable, secure, and cost-efficient storage solutions across S3, EBS, and EFS.

## Amazon S3 Object Storage Best Practices

Amazon S3 provides unlimited durability and scale for static assets, data lakes, and backups. The Agent Toolkit enforces strict validation and security patterns through dedicated specialized skills.

### Security and Access Control

In [`skills/specialized-skills/storage-skills/securing-s3-buckets/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/storage-skills/securing-s3-buckets/SKILL.md), the toolkit implements **put-bucket-policy safety rules** that require retrieving existing policies, creating backups, and merging statements before applying changes (line 85).

Always enforce **encryption in transit** by applying bucket policies that deny insecure transport:

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyInsecureTransport",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": [
      "arn:aws:s3:::my-secure-bucket/*",
      "arn:aws:s3:::my-secure-bucket"
    ],
    "Condition": {
      "Bool": {
        "aws:SecureTransport": "false"
      }
    }
  }]
}

```

Enable **SSE-S3** or **SSE-KMS** for encryption at rest (line 22), and apply lifecycle rules to transition older objects to S3 Glacier or Intelligent-Tiering for cost optimization.

### Data Model and Troubleshooting

The **S3 Files** troubleshooting skill in [`skills/specialized-skills/storage-skills/troubleshooting-s3-files/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/storage-skills/troubleshooting-s3-files/SKILL.md) enforces a key-length limit of 1,024 bytes, generating `PathTooLong` errors when exceeded (line 125).

Common troubleshooting patterns include:

- **Client installation**: Install `amazon-efs-utils` version 3.0 or later (`sudo yum -y install amazon-efs-utils`) to resolve `mount.s3files: command not found` errors (lines 50-54)
- **Synchronization issues**: Monitor the **PendingExports** CloudWatch metric; growing values indicate write-back lag with `ExportError` values such as `S3AccessDenied` or `PathTooLong` (lines 119-125)
- **IAM permissions**: Ensure compute roles include `s3files:ClientMount` or `s3files:ClientWrite` permissions (lines 84-100)

## Amazon EBS Block Storage Optimization

Amazon EBS provides persistent block storage for EC2 instances, databases, and stateful containers. The toolkit defaults to modern, cost-effective volume types.

### Provisioning Encrypted gp3 Volumes

According to [`skills/specialized-skills/ec2-skills/launching-ec2-instance-with-best-practices/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/ec2-skills/launching-ec2-instance-with-best-practices/SKILL.md), the toolkit automatically creates **encrypted gp3 EBS volumes** (default 50 GB) and tags them for cost allocation when launching EC2 instances (line 37).

**gp3 volumes** provide up to 16,000 IOPS and 1,000 MiB/s throughput without requiring capacity-provisioned storage, making them ideal for most workloads:

```bash

# Create an encrypted gp3 volume

aws ec2 create-volume \
    --size 50 \
    --volume-type gp3 \
    --encrypted \
    --region us-east-1 \
    --availability-zone us-east-1a

# Attach to instance

aws ec2 attach-volume \
    --volume-id vol-0abcd1234efgh5678 \
    --instance-id i-0123456789abcdef0 \
    --device /dev/xvdf

```

### Migration and Cost Savings

The [`skills/core-skills/aws-billing-and-cost-management/references/ebs-optimization.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-billing-and-cost-management/references/ebs-optimization.md) reference documents migrating from **gp2 to gp3** to save up to 30%, as gp3 is cheaper per GB and per IOPS while offering consistent performance.

### Snapshot Strategies

Create **incremental snapshots** stored in S3 for point-in-time backups:

```bash

# Create snapshot for backup

aws ec2 create-snapshot \
    --volume-id vol-0abcd1234efgh5678 \
    --description "Daily backup"

# Automate snapshot creation for all attached volumes

vol_ids=$(aws ec2 describe-instances \
    --instance-ids i-0123456789abcdef0 \
    --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' \
    --output text)

for vol in $vol_ids; do
    aws ec2 create-snapshot \
        --volume-id $vol \
        --description "Daily backup of $vol"
done

```

## Amazon EFS Managed File Systems

Amazon EFS provides managed NFS storage for shared file access across multiple EC2 instances or ECS tasks.

### Performance Modes and Throughput

In [`skills/specialized-skills/storage-skills/troubleshooting-efs/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/storage-skills/troubleshooting-efs/SKILL.md), the toolkit recommends **General Purpose** performance mode for most workloads, while **Max I/O** supports large, parallel workloads requiring higher aggregate throughput (lines 17-20).

For throughput modes, choose **Bursting** (default) for variable workloads. If your application sustains more than 250 MiB/s, switch to **Provisioned** throughput:

```bash
aws efs update-file-system \
    --file-system-id fs-12345678 \
    --provisioned-throughput-in-mibps 500

```

This configuration is documented at lines 111-115 of the EFS troubleshooting skill.

### Security and Mount Configuration

Enforce **IAM authentication** by attaching `elasticfilesystem:ClientMount` permissions and applying a file system policy that denies anonymous mounts (lines 83-90). Always encrypt data in transit using the `-o tls` mount option (line 71).

Verify security group rules allow NFS traffic on port 2049:

```bash

# Check existing rules

aws ec2 describe-security-groups \
    --group-ids sg-0mounttarget \
    --query 'SecurityGroups[0].IpPermissions[?FromPort==`2049` && ToPort==`2049`].IpRanges' \
    --output text

# Add rule if missing

aws ec2 authorize-security-group-ingress \
    --group-id sg-0mounttarget \
    --protocol tcp \
    --port 2049 \
    --source-group sg-0compute

```

### Installation and Setup

Install the **amazon-efs-utils** package for automatic DNS resolution, encryption, and retry logic (lines 46-54):

```bash

# Install mount helper

sudo yum -y install amazon-efs-utils

# Create encrypted file system

fs_id=$(aws efs create-file-system \
    --performance-mode generalPurpose \
    --encrypted \
    --region us-east-1 \
    --query 'FileSystemId' --output text)

# Create mount target in each AZ

aws efs create-mount-target \
    --file-system-id $fs_id \
    --subnet-id subnet-12345 \
    --security-groups sg-012345678

# Mount with TLS encryption

sudo mkdir -p /mnt/efs
sudo mount -t efs -o tls $fs_id:/ /mnt/efs

```

For container workloads, reference [`skills/core-skills/aws-containers/references/task-definition-authoring.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-containers/references/task-definition-authoring.md) (lines 162-170) to attach EFS volumes to ECS or Fargate tasks.

## Implementation Checklist

| Checklist Item | S3 | EBS | EFS |
|---|---|---|---|
| **Encryption at rest** | Enable SSE-S3 or SSE-KMS (line 22 in securing-s3-buckets) | Use `--encrypted` flag; gp3 supports encryption by default | Set `--encrypted` on creation |
| **Encryption in transit** | HTTPS endpoints; TLS for S3 Files (line 71) | Not applicable | Mount with `-o tls` |
| **IAM least-privilege** | Granular bucket policies; avoid `AmazonS3FullAccess` | Role with `ec2:AttachVolume` and `ec2:CreateSnapshot` | `elasticfilesystem:ClientMount` with file-system policy |
| **Performance tuning** | Transfer Acceleration; multipart upload | Choose gp3; provision IOPS/throughput | Switch to Provisioned throughput if >250 MiB/s sustained |
| **Cost controls** | Lifecycle rules; Intelligent-Tiering | gp2 to gp3 migration; delete unused volumes | EFS-One-Zone for lower cost |

## Summary

- **Amazon S3**: Implement bucket policies that deny insecure transport (line 85), enforce key-length limits (line 125), and use lifecycle policies for cost optimization.
- **Amazon EBS**: Default to encrypted gp3 volumes (line 37) for 30% cost savings over gp2, and automate incremental snapshots for backup.
- **Amazon EFS**: Use General Purpose mode (lines 17-20) with TLS encryption (line 71), and scale to Provisioned throughput (lines 111-115) for high I/O workloads.
- **Cross-service**: Install `amazon-efs-utils` (lines 46-54) for reliable mounting, apply least-privilege IAM policies, and monitor CloudWatch metrics for early bottleneck detection.

## Frequently Asked Questions

### What is the difference between EBS and EFS storage?

**Amazon EBS** provides block-level storage attached to single EC2 instances with provisioned IOPS and durability through snapshots, while **Amazon EFS** offers managed NFS file systems accessible from multiple instances simultaneously with elastic throughput. According to the Agent Toolkit, EBS is ideal for databases and boot volumes requiring consistent low-latency performance, whereas EFS suits shared content repositories and container storage that require POSIX compliance and concurrent access.

### How do I secure S3 buckets against unauthorized access?

Follow the securing-s3-buckets skill by applying bucket policies that explicitly deny requests where `aws:SecureTransport` is `false` (line 85), enable default encryption using SSE-KMS, and avoid using global permissions like `AmazonS3FullAccess`. The toolkit mandates retrieving existing policies and creating backups before merging new statements to prevent accidental lockouts.

### When should I switch from gp2 to gp3 EBS volumes?

Migrate immediately according to [`ebs-optimization.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/ebs-optimization.md), as gp3 volumes cost up to 30% less per GB while offering higher baseline performance (3,000 IOPS and 125 MiB/s) without capacity constraints. The launch-ec2-instance-with-best-practices skill defaults to gp3 (line 37) for all new instances, and you can modify existing volumes without detachment using the AWS CLI or Console.

### How do I troubleshoot EFS mount failures?

First verify that `amazon-efs-utils` is installed (lines 46-54 in troubleshooting-efs). Then check that the mount target's security group allows inbound TCP traffic on port 2049 from your compute instances. Finally, ensure your IAM role includes `elasticfilesystem:ClientMount` permissions and that you are using the `-o tls` option for encryption in transit (line 71).