-
-
-
-
-
-
AWS mount points
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Prepare AWS storage for Mount Points
AWS Mount Points give a project shared, persistent, POSIX file storage that is mounted into its workspace pods at
/mnt/<mount-point-name>. Every workspace that mounts it reads and writes the same files, live. It is collaborative
shared storage, not per-user storage.
Two AWS backends are supported, both through the efs.csi.aws.com driver:
- Amazon EFS — elastic NFS file storage.
- Amazon S3 Files — a file system built on EFS over an S3 bucket. The same bytes are reachable as objects and as files.
Important
AWS Mount Points depend on AWS resources that Citrix SecurSpaces™ does not create and does not validate. Unlike Azure file storage, the EFS CSI driver cannot create a file system — it can only carve access points inside a file system that already exists. You must provision the file system, mount targets, security groups, IAM roles, and StorageClasses yourself before anyone can use the feature.
If these prerequisites are missing, the feature usually fails silently rather than reporting an error. An empty create dialog, a workspace that hangs while starting, or a mount that runs unencrypted are all symptoms of incomplete AWS preparation.
Priority checklist
Review these before your first deployment. Each one either breaks the feature or weakens data security.
| Requirement | What happens if you miss it |
|---|---|
Set tls as a mount option on every StorageClass and every PersistentVolume you author. |
NFS traffic travels unencrypted over the VPC on port 2049. |
| Grant the workspace service read access to StorageClasses. | The encryption check cannot run and is skipped, so an unencrypted mount can succeed. |
Name an access point in volumeHandle. Never publish a bare file system id. |
The mount exposes every other project’s data on that file system. |
Label every PersistentVolume you author with strong.network/mount-point-scope. |
An unlabeled volume is offered to nobody. A wrongly scoped one is offered to the wrong projects. |
Set persistentVolumeReclaimPolicy: Retain on volumes you author. |
Deleting a Mount Point can destroy the underlying data. |
Set storageClassName: "" on volumes you author. |
Kubernetes applies the default StorageClass and the static bind fails. |
| Create one mount target per Availability Zone your node group uses, and allow NFS on port 2049. | Workspaces scheduled in an Availability Zone with no mount target hang while starting. |
| Create the file system with encryption at rest, and enable automatic backups. | Data is stored unencrypted, and deletions are permanent and unrecoverable. |
| Use one cloud provider per cluster. | Mixed AWS and Azure StorageClasses withdraw the feature from all users. |
Warning
Do not rename the technical identifiers in this article to match the product name. The volume label key
strong.network/mount-point-scope, the metric names, and the Helm value paths kept their original spelling deliberately. A renamed label makes the volume visible to nobody, with no error message.
How to use this section
| Page | What it covers |
|---|---|
| Prepare the AWS resources | Mount targets, security groups, Amazon EFS and Amazon S3 Files prerequisites, IAM scoping, instance metadata hardening |
| Configure SecurSpaces | The StorageClass, encryption in transit, and enabling the feature |
| Author a PersistentVolume | Publishing your own volume for Attach Existing |
| Troubleshooting | Symptoms, causes, and fixes |
| Mount point limits and behavior | Quotas, deletion semantics, Amazon S3 Files behavior, multi-region, and metrics |
Share
Share
In this article
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.