Amazon EFS

Manage file-system and access-point records through the EFS API.

Plan: Free31 of 31 operations implemented5Known differences

The examples verify configuration records, not working NFS mounts or file data.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

This Free service needs no license key. Start Vera as in Get started, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

The example uses the AWS CLI’s efs commands. The emulator serves the 2015-02-01 API over the REST JSON protocol, and the example was checked with the official AWS CLI 2.31.35.

Example

Create an encrypted file system and describe it. This creates a configuration record: nothing is mounted and no file data is stored.

FS_ID=$(aws --endpoint-url "$VERA_ENDPOINT" efs create-file-system \
  --creation-token vera-docs-storage-efs --encrypted --tags Key=Name,Value=docs-efs \
  --query FileSystemId --output text)
aws --endpoint-url "$VERA_ENDPOINT" efs describe-file-systems --file-system-id "$FS_ID"

The description includes these fields. The file system’s ID and ARN and its creation time differ on every run.

{
    "FileSystems": [
        {
            "LifeCycleState": "available",
            "NumberOfMountTargets": 0,
            "SizeInBytes": {
                "Value": 6144
            },
            "PerformanceMode": "generalPurpose",
            "Encrypted": true,
            "ThroughputMode": "bursting"
        }
    ]
}

The whole output

{
    "FileSystems": [
        {
            "OwnerId": "123456789012",
            "CreationToken": "vera-docs-storage-efs",
            "FileSystemId": "fs-634cd1660d5d4af28",
            "FileSystemArn": "arn:aws:elasticfilesystem:us-east-1:123456789012:file-system/fs-634cd1660d5d4af28",
            "CreationTime": "2026-11-03T18:11:40+00:00",
            "LifeCycleState": "available",
            "Name": "docs-efs",
            "NumberOfMountTargets": 0,
            "SizeInBytes": {
                "Value": 6144,
                "ValueInIA": 0,
                "ValueInStandard": 6144,
                "ValueInArchive": 0
            },
            "PerformanceMode": "generalPurpose",
            "Encrypted": true,
            "KmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/44d4788d-9979-5328-955e-bf9284eeebe7",
            "ThroughputMode": "bursting",
            "Tags": [
                {
                    "Key": "Name",
                    "Value": "docs-efs"
                }
            ],
            "FileSystemProtection": {
                "ReplicationOverwriteProtection": "ENABLED"
            }
        }
    ]
}

Encrypted and the KMS key ARN are returned settings: they don’t show a working encryption path.

Add an access point with a POSIX user and a root directory, and describe it:

AP_ID=$(aws --endpoint-url "$VERA_ENDPOINT" efs create-access-point \
  --file-system-id "$FS_ID" --client-token vera-docs-storage-ap \
  --posix-user Uid=1000,Gid=1000 \
  --root-directory '{"Path":"/docs","CreationInfo":{"OwnerUid":1000,"OwnerGid":1000,"Permissions":"750"}}' \
  --query AccessPointId --output text)
aws --endpoint-url "$VERA_ENDPOINT" efs describe-access-points --access-point-id "$AP_ID"

The description includes these fields. The access point’s ID and ARN differ on every run.

{
    "AccessPoints": [
        {
            "PosixUser": {
                "Uid": 1000,
                "Gid": 1000
            },
            "RootDirectory": {
                "Path": "/docs",
                "CreationInfo": {
                    "Permissions": "750"
                }
            },
            "LifeCycleState": "available"
        }
    ]
}

To clean up, delete the access point, then the file system:

aws --endpoint-url "$VERA_ENDPOINT" efs delete-access-point --access-point-id "$AP_ID"
aws --endpoint-url "$VERA_ENDPOINT" efs delete-file-system --file-system-id "$FS_ID"

Supported features

These are configuration records: see Limitations for what wasn’t verified.

File system records, created with a creation token, encryption and tags, described and deleted. In earlier testing, describing a deleted file system returned FileSystemNotFound.
Access point records, created with a POSIX user and a root directory, described and deleted. In an earlier recorded comparison, CreateAccessPoint matched AWS’s response.
Tags: in an earlier recorded comparison, TagResource matched AWS’s response.
Replication configuration records, created and described in earlier testing. In a recorded comparison they reported ENABLED at once, where AWS reported ENABLING. Replicating file data wasn’t verified.
Account preferences: in an earlier recorded comparison, selected DescribeAccountPreferences and PutAccountPreferences calls matched AWS’s responses.
Mount targets and file system updates, on errors only: in an earlier recorded comparison, CreateMountTarget, DeleteMountTarget, DescribeMountTargets, DescribeMountTargetSecurityGroups, UpdateFileSystem and UpdateFileSystemProtection matched AWS’s error responses. Their successful responses weren’t compared. ModifyMountTargetSecurityGroups has a validation difference: see Limitations.
Also served, not yet tested: file system policies, and backup and lifecycle policies.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

No file storage was verified. NFS mounts, permission enforcement, file writes, networking and replicated data weren’t validated, so this page covers the EFS API’s records, not files. The Encrypted flag and KMS key ARN don’t show that anything is encrypted.
New file systems are ready at once. In Vera 1.2.2, as in the example, the first description of a new file system is already available, with 6,144 bytes. In an earlier recorded comparison, CreateFileSystem returned available where AWS returned creating, and AWS showed available and 6,144 bytes only in a later description.
Mount networking wasn’t tested. Mount-target calls were compared only on error responses, and an invalid ModifyMountTargetSecurityGroups request’s error differed from AWS’s. Working mount targets, and how their network interfaces appear in EC2, weren’t tested, and neither were successful file system updates, protection changes or replication lifecycles.

API coverage

Every operation in AWS's published 2015-02-01 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. What the statuses mean

Operation	Status	Notes
CreateAccessPoint	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — created an access point with a POSIX user and a `/docs` root directory with permissions `750`. Permission enforcement wasn't checked.
CreateFileSystem	Known difference	Recorded comparison: Returns a `LifeCycleState` of `available` at once, where AWS returns `creating`. Local observation: Vera 1.2.0 preview, 5 November 2026 — created an encrypted file system record with a creation token and tags. No mount or file data was checked.
CreateMountTarget	Implemented
CreateReplicationConfiguration	Known difference	Recorded comparison: In the compared setup, the emulator immediately reports the replication destination as `ENABLED`, while the AWS recording reports `ENABLING`. This tests configuration state, not replication of file data.
CreateTags	Implemented
DeleteAccessPoint	Implemented
DeleteFileSystem	Implemented
DeleteFileSystemPolicy	Implemented
DeleteMountTarget	Implemented
DeleteReplicationConfiguration	Implemented
DeleteTags	Implemented
DescribeAccessPoints	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned the access point `available`, with its POSIX user and root directory.
DescribeAccountPreferences	Implemented
DescribeBackupPolicy	Implemented
DescribeFileSystemPolicy	Implemented
DescribeFileSystems	Known difference	Recorded comparison: The first description of a new file system is already `available`, with a `SizeInBytes` of `6144`, where AWS's first was `creating` with `0`. AWS's later description, once available, matched. Local observation: Vera 1.2.0 preview, 5 November 2026 — the first description was already `available`, `Encrypted`, with `0` mount targets and a `SizeInBytes` value of `6144`. The returned KMS key ARN doesn't establish encryption.
DescribeLifecycleConfiguration	Implemented
DescribeMountTargetSecurityGroups	Implemented
DescribeMountTargets	Implemented
DescribeReplicationConfigurations	Known difference	Recorded comparison: For the replication configuration created by the case, the emulator reports `ENABLED` while the AWS recording reports `ENABLING`. Differences caused by unrelated pre-existing configurations were excluded. File replication was not verified.
DescribeTags	Implemented
ListTagsForResource	Implemented
ModifyMountTargetSecurityGroups	Known difference	Recorded comparison: For a request naming missing mount-target and security-group identifiers, the emulator returns `ValidationException` for the security-group reference; the AWS recording returns `MountTargetNotFound`. This covers validation order and error codes, not working mount networking.
PutAccountPreferences	Implemented
PutBackupPolicy	Implemented
PutFileSystemPolicy	Implemented
PutLifecycleConfiguration	Implemented
TagResource	Implemented
UntagResource	Implemented
UpdateFileSystem	Implemented
UpdateFileSystemProtection	Implemented