MultiCloud Classroom notes 11/Sep/2026

Aws s3 file system mount

• S3fs is available only for Linux operating systems

pre-request

• s3 bucket with enable versions
• create s3 file system with in vpc
• check mount target availablity zone need selected
• auth methods
  • iam role attached to ec2 instance/lambda provide least previllage access
  • iam user
• compute resource
  • ec2
  • lambda
  • ecs

iam role for s3 access in vm

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3BucketPermissions",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketVersions"
            ],
            "Resource": "arn:aws:s3:::bucket",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "497650754350"
                }
            }
        },
        {
            "Sid": "S3ObjectPermissions",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject*",
                "s3:GetObject*",
                "s3:List*",
                "s3:PutObject*"
            ],
            "Resource": "arn:aws:s3:::qt-devops-s3/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "497650754350"
                }
            }
        },
        {
            "Sid": "UseKmsKeyWithS3Files",
            "Effect": "Allow",
            "Action": [
                "kms:GenerateDataKey",
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncryptFrom",
                "kms:ReEncryptTo"
            ],
            "Condition": {
                "StringLike": {
                    "kms:ViaService": "s3.region.amazonaws.com",
                    "kms:EncryptionContext:aws:s3:arn": [
                        "arn:aws:s3:::qt-devops-s3",
                        "arn:aws:s3:::qt-devops-s3/*"
                    ]
                }
            },
            "Resource": "arn:aws:kms:region:497650754350:*"
        },
        {
            "Sid": "EventBridgeManage",
            "Effect": "Allow",
            "Action": [
                "events:DeleteRule",
                "events:DisableRule",
                "events:EnableRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets"
            ],
            "Condition": {
                "StringEquals": {
                    "events:ManagedBy": "elasticfilesystem.amazonaws.com"
                }
            },
            "Resource": [
                "arn:aws:events:*:*:rule/DO-NOT-DELETE-S3-Files*"
            ]
        },
        {
            "Sid": "EventBridgeRead",
            "Effect": "Allow",
            "Action": [
                "events:DescribeRule",
                "events:ListRuleNamesByTarget",
                "events:ListRules",
                "events:ListTargetsByRule"
            ],
            "Resource": [
                "arn:aws:events:*:*:rule/*"
            ]
        }
    ]
}

or attach existing policy AmazonS3FullAccess

setup ec2 instance with iam role

Install s3fs

sudo apt update 
sudo apt-get install s3fs -y
s3fs --version 

1. using iam role
2. using iam user
   1. accesskey
   2. screctkey

echo "accesskey:screctkey" > ~/.password-s3fs
chmod 600 ~/.password-s3fs

echo "AKIAXHXSL4MXLNKV5HKW:XBHr1Gc4tIjYKMw8eeZSssHg46IKrDoXHZeYKyLN" > ~/.password-s3fs
chmod ~/.password-s3fs

/etc/fuse.config

edit file and add user_allow_other

sudo echo "user_allow_other" >>  /etc/fuse.conf

mount s3

sudo mkdir /mnt/qt-devops-s3
sudo chown ubuntu:ubuntu /mnt/qt-devops-s3

sudo s3fs your-bucket-name /path/to/mountpoint -o iam_role="YourRoleName" -o allow_other

sudo s3fs qt-devops-s3 /mnt/qt-devops-s3 \
  -o iam_role=auto \
  -o url=https://s3.eu-north-1.amazonaws.com \
  -o endpoint=eu-north-1 \
  -o use_path_request_style \
  -o allow_other

sudo mkdir /mnt/qt-devops-s3-password
sudo chown ubuntu:ubuntu /mnt/qt-devops-s3-password
sudo s3fs qt-devops-s3 /mnt/qt-devops-s3-password \
  -o passwd_file=~/.password-s3fs \
  -o url=https://s3.eu-north-1.amazonaws.com \
  -o endpoint=eu-north-1 \
  -o use_path_request_style \
  -o allow_other

!#/bin/bash
sudo apt update
sudo apt install s3fs -y 
sudo echo "user_allow_other" >>  /etc/fuse.conf
sudo mkdir /mnt/qt-devops-s3
sudo chown ubuntu:ubuntu /mnt/qt-devops-s3
sudo s3fs qt-devops-s3 /mnt/qt-devops-s3 \
  -o iam_role=auto \
  -o url=https://s3.eu-north-1.amazonaws.com \
  -o endpoint=eu-north-1 \
  -o use_path_request_style \
  -o allow_other

task

1. create ec2 instances mount s3fs role base and password based follow the class recording.