How to Use AWS Storage Services Effectively (S3, EBS, EFS)

Use Amazon S3 for scalable object storage with lifecycle policies and TLS enforcement, Amazon EBS for persistent encrypted block storage using gp3 volumes, and Amazon EFS for shared POSIX-compliant file systems with elastic throughput, following the security and provisioning patterns codified in the Agent Toolkit for AWS.

The aws/agent-toolkit-for-aws repository provides production-ready skills that encapsulate best practices for provisioning, securing, and troubleshooting AWS storage services. This guide extracts concrete implementation patterns directly from the toolkit's source code to help you architect durable, secure, and cost-efficient storage solutions across S3, EBS, and EFS.

Amazon S3 Object Storage Best Practices

Amazon S3 provides unlimited durability and scale for static assets, data lakes, and backups. The Agent Toolkit enforces strict validation and security patterns through dedicated specialized skills.

Security and Access Control

In skills/specialized-skills/storage-skills/securing-s3-buckets/SKILL.md, the toolkit implements put-bucket-policy safety rules that require retrieving existing policies, creating backups, and merging statements before applying changes (line 85).

Always enforce encryption in transit by applying bucket policies that deny insecure transport:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyInsecureTransport",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": [
      "arn:aws:s3:::my-secure-bucket/*",
      "arn:aws:s3:::my-secure-bucket"
    ],
    "Condition": {
      "Bool": {
        "aws:SecureTransport": "false"
      }
    }
  }]
}

Enable SSE-S3 or SSE-KMS for encryption at rest (line 22), and apply lifecycle rules to transition older objects to S3 Glacier or Intelligent-Tiering for cost optimization.

Data Model and Troubleshooting

The S3 Files troubleshooting skill in skills/specialized-skills/storage-skills/troubleshooting-s3-files/SKILL.md enforces a key-length limit of 1,024 bytes, generating PathTooLong errors when exceeded (line 125).

Common troubleshooting patterns include:

• Client installation: Install amazon-efs-utils version 3.0 or later (sudo yum -y install amazon-efs-utils) to resolve mount.s3files: command not found errors (lines 50-54)
• Synchronization issues: Monitor the PendingExports CloudWatch metric; growing values indicate write-back lag with ExportError values such as S3AccessDenied or PathTooLong (lines 119-125)
• IAM permissions: Ensure compute roles include s3files:ClientMount or s3files:ClientWrite permissions (lines 84-100)

Amazon EBS Block Storage Optimization

Amazon EBS provides persistent block storage for EC2 instances, databases, and stateful containers. The toolkit defaults to modern, cost-effective volume types.

Provisioning Encrypted gp3 Volumes

According to skills/specialized-skills/ec2-skills/launching-ec2-instance-with-best-practices/SKILL.md, the toolkit automatically creates encrypted gp3 EBS volumes (default 50 GB) and tags them for cost allocation when launching EC2 instances (line 37).

gp3 volumes provide up to 16,000 IOPS and 1,000 MiB/s throughput without requiring capacity-provisioned storage, making them ideal for most workloads:

# Create an encrypted gp3 volume

aws ec2 create-volume \
    --size 50 \
    --volume-type gp3 \
    --encrypted \
    --region us-east-1 \
    --availability-zone us-east-1a

# Attach to instance

aws ec2 attach-volume \
    --volume-id vol-0abcd1234efgh5678 \
    --instance-id i-0123456789abcdef0 \
    --device /dev/xvdf

Migration and Cost Savings

The skills/core-skills/aws-billing-and-cost-management/references/ebs-optimization.md reference documents migrating from gp2 to gp3 to save up to 30%, as gp3 is cheaper per GB and per IOPS while offering consistent performance.

Snapshot Strategies

Create incremental snapshots stored in S3 for point-in-time backups:

# Create snapshot for backup

aws ec2 create-snapshot \
    --volume-id vol-0abcd1234efgh5678 \
    --description "Daily backup"

# Automate snapshot creation for all attached volumes

vol_ids=$(aws ec2 describe-instances \
    --instance-ids i-0123456789abcdef0 \
    --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' \
    --output text)

for vol in $vol_ids; do
    aws ec2 create-snapshot \
        --volume-id $vol \
        --description "Daily backup of $vol"
done

Amazon EFS Managed File Systems

Amazon EFS provides managed NFS storage for shared file access across multiple EC2 instances or ECS tasks.

Performance Modes and Throughput

In skills/specialized-skills/storage-skills/troubleshooting-efs/SKILL.md, the toolkit recommends General Purpose performance mode for most workloads, while Max I/O supports large, parallel workloads requiring higher aggregate throughput (lines 17-20).

For throughput modes, choose Bursting (default) for variable workloads. If your application sustains more than 250 MiB/s, switch to Provisioned throughput:

aws efs update-file-system \
    --file-system-id fs-12345678 \
    --provisioned-throughput-in-mibps 500

This configuration is documented at lines 111-115 of the EFS troubleshooting skill.

Security and Mount Configuration

Enforce IAM authentication by attaching elasticfilesystem:ClientMount permissions and applying a file system policy that denies anonymous mounts (lines 83-90). Always encrypt data in transit using the -o tls mount option (line 71).

Verify security group rules allow NFS traffic on port 2049:

# Check existing rules

aws ec2 describe-security-groups \
    --group-ids sg-0mounttarget \
    --query 'SecurityGroups[0].IpPermissions[?FromPort==`2049` && ToPort==`2049`].IpRanges' \
    --output text

# Add rule if missing

aws ec2 authorize-security-group-ingress \
    --group-id sg-0mounttarget \
    --protocol tcp \
    --port 2049 \
    --source-group sg-0compute

Installation and Setup

Install the amazon-efs-utils package for automatic DNS resolution, encryption, and retry logic (lines 46-54):

# Install mount helper

sudo yum -y install amazon-efs-utils

# Create encrypted file system

fs_id=$(aws efs create-file-system \
    --performance-mode generalPurpose \
    --encrypted \
    --region us-east-1 \
    --query 'FileSystemId' --output text)

# Create mount target in each AZ

aws efs create-mount-target \
    --file-system-id $fs_id \
    --subnet-id subnet-12345 \
    --security-groups sg-012345678

# Mount with TLS encryption

sudo mkdir -p /mnt/efs
sudo mount -t efs -o tls $fs_id:/ /mnt/efs

For container workloads, reference skills/core-skills/aws-containers/references/task-definition-authoring.md (lines 162-170) to attach EFS volumes to ECS or Fargate tasks.

Implementation Checklist

Checklist Item	S3	EBS	EFS
Encryption at rest	Enable SSE-S3 or SSE-KMS (line 22 in securing-s3-buckets)	Use --encrypted flag; gp3 supports encryption by default	Set --encrypted on creation
Encryption in transit	HTTPS endpoints; TLS for S3 Files (line 71)	Not applicable	Mount with -o tls
IAM least-privilege	Granular bucket policies; avoid AmazonS3FullAccess	Role with ec2:AttachVolume and ec2:CreateSnapshot	elasticfilesystem:ClientMount with file-system policy
Performance tuning	Transfer Acceleration; multipart upload	Choose gp3; provision IOPS/throughput	Switch to Provisioned throughput if >250 MiB/s sustained
Cost controls	Lifecycle rules; Intelligent-Tiering	gp2 to gp3 migration; delete unused volumes	EFS-One-Zone for lower cost

Summary

• Amazon S3: Implement bucket policies that deny insecure transport (line 85), enforce key-length limits (line 125), and use lifecycle policies for cost optimization.
• Amazon EBS: Default to encrypted gp3 volumes (line 37) for 30% cost savings over gp2, and automate incremental snapshots for backup.
• Amazon EFS: Use General Purpose mode (lines 17-20) with TLS encryption (line 71), and scale to Provisioned throughput (lines 111-115) for high I/O workloads.
• Cross-service: Install amazon-efs-utils (lines 46-54) for reliable mounting, apply least-privilege IAM policies, and monitor CloudWatch metrics for early bottleneck detection.

Frequently Asked Questions

What is the difference between EBS and EFS storage?

Amazon EBS provides block-level storage attached to single EC2 instances with provisioned IOPS and durability through snapshots, while Amazon EFS offers managed NFS file systems accessible from multiple instances simultaneously with elastic throughput. According to the Agent Toolkit, EBS is ideal for databases and boot volumes requiring consistent low-latency performance, whereas EFS suits shared content repositories and container storage that require POSIX compliance and concurrent access.

How do I secure S3 buckets against unauthorized access?

Follow the securing-s3-buckets skill by applying bucket policies that explicitly deny requests where aws:SecureTransport is false (line 85), enable default encryption using SSE-KMS, and avoid using global permissions like AmazonS3FullAccess. The toolkit mandates retrieving existing policies and creating backups before merging new statements to prevent accidental lockouts.

When should I switch from gp2 to gp3 EBS volumes?

Migrate immediately according to ebs-optimization.md, as gp3 volumes cost up to 30% less per GB while offering higher baseline performance (3,000 IOPS and 125 MiB/s) without capacity constraints. The launch-ec2-instance-with-best-practices skill defaults to gp3 (line 37) for all new instances, and you can modify existing volumes without detachment using the AWS CLI or Console.

How do I troubleshoot EFS mount failures?

First verify that amazon-efs-utils is installed (lines 46-54 in troubleshooting-efs). Then check that the mount target's security group allows inbound TCP traffic on port 2049 from your compute instances. Finally, ensure your IAM role includes elasticfilesystem:ClientMount permissions and that you are using the -o tls option for encryption in transit (line 71).

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}