Storage Skills

Skill 125 of 130

Troubleshooting S3 Files

Diagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues.

3 minutes · 660 words · 20 sections

Install

$ npx skills add aws/agent-toolkit-for-aws --skill troubleshooting-s3-files

$ npx skills add aws/agent-toolkit-for-aws

» /plugin marketplace add aws/agent-toolkit-for-aws

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Overview

Diagnoses and resolves Amazon S3 Files issues: mount failures, IAM permissions, synchronization, conflict resolution, and performance.

For authoritative guidance, see S3 Files Troubleshooting (opens in a new tab).

Common Tasks

0. Verify Dependencies

You MUST verify aws CLI is available with s3files subcommand support
You MUST confirm valid AWS credentials
You MUST ONLY check for tool existence and version — MUST NOT execute destructive or mutating commands during verification
You MUST inform the user if any required tools are missing
You MUST respect the user’s decision to abort if tools are unavailable
You SHOULD explain steps before executing and wait for user confirmation on write commands

1. Classify the Issue

Symptom	Category
mount.s3files: command not found	A: Client Installation
Connection timed out during mount	B: Network/Security Group
Mount hangs indefinitely (no timeout)	B: Network/Security Group
Access denied during mount	C: IAM Permissions
File system stuck in “creating”	C: IAM Permissions
Permission denied on file operations	C: IAM Permissions
Files not appearing in S3 after write	D: Synchronization
Files in .s3files-lost+found directory	E: Conflict Resolution
Slow reads or high latency	F: Performance
NFS server error	G: Encryption/KMS
DNS name resolution fails	H: VPC DNS

2. Category A — Client Installation

mount.s3files: command not found means amazon-efs-utils is missing or < v3.0.0.

sudo yum -y install amazon-efs-utils  # Amazon Linux

3. Category B — Network/Security Group

Connection timeout is the #1 mount failure — almost always security groups.

Verify mount target exists in the instance’s AZ:

aws s3files list-mount-targets --file-system-id fs-ID --region REGION

Cross-AZ mounting works but adds latency.

Verify security groups — most common fix:

Mount target SG MUST have inbound TCP 2049 from compute SG
Compute SG MUST have outbound TCP 2049 to mount target SG
Fix: aws ec2 authorize-security-group-ingress --group-id sg-MT --protocol tcp --port 2049 --source-group sg-COMPUTE

Test connectivity:

nc -zv az-ID.fs-ID.s3files.REGION.on.aws 2049

Note: These SG troubleshooting steps also apply to EFS — use aws efs describe-mount-targets instead.

Mount hangs in isolated VPC: If the VPC has no internet access, S3 Files requires a CloudWatch Logs VPC endpoint (com.amazonaws.REGION.logs) for mount to complete.

4. Category C — IAM Permissions

File system stuck in “creating” status: S3 Files does NOT validate IAM role permissions at creation time. Wrong trust policy or missing permissions → stuck in creating with access denied in statusMessage.

Check status:

aws s3files get-file-system --file-system-id fs-ID --region REGION

Check statusMessage. If access denied, fix the IAM role and delete/recreate.

Mount access denied: Compute role needs s3files:ClientMount. For dev/test only, AmazonS3FilesClientFullAccess is acceptable — avoid in production.

Write permission denied: Compute role needs s3files:ClientWrite

Root access denied: Compute role needs s3files:ClientRootAccess. ⚠️ Bypasses POSIX permissions — prefer access points with scoped POSIX users.

Check file system policy:

aws s3files get-file-system-policy --file-system-id fs-ID --region REGION

5. Category D — Synchronization

Files not appearing in S3: Writes sync within ~60 seconds. Check status:

getfattr -n "user.s3files.status;$(date -u +%s)" filename --only-values

Common ExportError values:

Error	Fix
S3AccessDenied	File system IAM role lacks S3 write permissions
S3BucketNotFound	Bucket deleted or renamed
RoleAssumptionFailed	Trust policy misconfigured
EncryptionKeyInaccessible	KMS key disabled or permissions revoked
PathTooLong	File path exceeds 1,024 byte S3 key limit

Monitor: PendingExports CloudWatch metric. Growing = exceeds 800 files/sec rate.

6. Category E — Conflict Resolution

Files in .s3files-lost+found-{fs-id} = sync conflict (modified via FS and S3 simultaneously). S3 wins; FS version moved to lost+found.

7. Category F — Performance

First access latency: Normal — first directory access imports metadata.

Intelligent read routing not working: Compute role needs s3:GetObject on the bucket.

Slow writes: If PendingExports growing, distribute across multiple file systems.

8. Category G — Encryption/KMS

NFS server error with encrypted FS = KMS issue. Verify key is enabled and role has KMS permissions.

9. Category H — VPC DNS

DNS resolution failure = VPC DNS settings disabled.

aws ec2 describe-vpc-attribute --vpc-id vpc-ID --attribute enableDnsHostnames
aws ec2 describe-vpc-attribute --vpc-id vpc-ID --attribute enableDnsSupport

Both MUST be true. If not:

aws ec2 modify-vpc-attribute --vpc-id vpc-ID --enable-dns-hostnames Value=true
aws ec2 modify-vpc-attribute --vpc-id vpc-ID --enable-dns-support Value=true

Troubleshooting

AWS CLI endpoint URL cannot be resolved

CLI is too old for S3 Files. Run aws --version — if v1.x, upgrade to AWS CLI v2: Installing the AWS CLI (opens in a new tab).

ECS task fails with DNS resolution error

Used efsVolumeConfiguration instead of s3filesVolumeConfiguration. Fix: use fileSystemArn in S3 Files-specific volume config.

S3 Files vs other products confusion

S3 Files is NOT Mountpoint for S3, S3 File Gateway, or File Cache. Uses aws s3files CLI, s3files: IAM actions, mount -t s3files.

Enable Debug Logs

Set logging_level = DEBUG in /etc/amazon/efs/s3files-utils.conf. Logs at /var/log/amazon/efs/mount.log.

Collect Logs for AWS Support

sudo tar -czf /tmp/s3files-logs.tar.gz /var/log/amazon/efs/ /etc/amazon/efs/s3files-utils.conf

Security Considerations

When diagnosing IAM issues, verify least-privilege — avoid FullAccess as a shortcut
Without a file system policy, any VPC client can mount
Restrict /var/log/amazon/efs/ access — logs contain S3 key names

Additional Resources

About this skill

Trigger

Diagnoses and resolves Amazon S3 Files issues including mount failures, permission errors, synchronization problems, and performance issues. Use when the user has an S3 file system that is not mounting, returning access denied, not syncing changes to S3, showing files in lost+found, or performing slower than expected.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/aws/agent-toolkit-for-aws, branch main, last pushed 24 September 2026.

Licence

Apache-2.0 — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

130 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 19 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/end-user-computing-skills/*/SKILL.md, skills/specialized-skills/messaging-and-streaming-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/quantum-computing-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md, skills/specialized-skills/security-and-identity-skills/*/SKILL.md, skills/specialized-skills/serverless-skills/*/SKILL.md, skills/specialized-skills/storage-skills/*/SKILL.md, skills/specialized-skills/system-table-skills/*/SKILL.md, skills/specialized-skills/web-and-mobile-development/*/SKILL.md.

Duplicates collapsed

34 mirror copies folded into their canonical skill — republished for Alternate. Copies match on content hash and on position once a leading per-agent prefix is stripped, because the same skill is routinely shipped under a dozen agent directories with a dozen different hashes.

Issue colours

Resolved from a curated brand profile — hue 65°, chroma 0.174. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Removed “Troubleshooting S3 Files”, a leading h1 that duplicated the skill title.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .claude-plugin/marketplace.json by Amazon Web Services, declaring 4 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /aws/agent-toolkit-for-aws.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Overview

Diagnoses and resolves Amazon S3 Files issues: mount failures, IAM permissions, synchronization, conflict resolution, and performance.

For authoritative guidance, see S3 Files Troubleshooting (opens in a new tab).

Common Tasks

0. Verify Dependencies

You MUST verify aws CLI is available with s3files subcommand support
You MUST confirm valid AWS credentials
You MUST ONLY check for tool existence and version — MUST NOT execute destructive or mutating commands during verification
You MUST inform the user if any required tools are missing
You MUST respect the user’s decision to abort if tools are unavailable
You SHOULD explain steps before executing and wait for user confirmation on write commands

1. Classify the Issue

Symptom	Category
mount.s3files: command not found	A: Client Installation
Connection timed out during mount	B: Network/Security Group
Mount hangs indefinitely (no timeout)	B: Network/Security Group
Access denied during mount	C: IAM Permissions
File system stuck in “creating”	C: IAM Permissions
Permission denied on file operations	C: IAM Permissions
Files not appearing in S3 after write	D: Synchronization
Files in .s3files-lost+found directory	E: Conflict Resolution
Slow reads or high latency	F: Performance
NFS server error	G: Encryption/KMS
DNS name resolution fails	H: VPC DNS

2. Category A — Client Installation

mount.s3files: command not found means amazon-efs-utils is missing or < v3.0.0.

sudo yum -y install amazon-efs-utils  # Amazon Linux

3. Category B — Network/Security Group

Connection timeout is the #1 mount failure — almost always security groups.

Verify mount target exists in the instance’s AZ:

aws s3files list-mount-targets --file-system-id fs-ID --region REGION

Cross-AZ mounting works but adds latency.

Verify security groups — most common fix:

Mount target SG MUST have inbound TCP 2049 from compute SG
Compute SG MUST have outbound TCP 2049 to mount target SG
Fix: aws ec2 authorize-security-group-ingress --group-id sg-MT --protocol tcp --port 2049 --source-group sg-COMPUTE

Test connectivity:

nc -zv az-ID.fs-ID.s3files.REGION.on.aws 2049

Note: These SG troubleshooting steps also apply to EFS — use aws efs describe-mount-targets instead.

Mount hangs in isolated VPC: If the VPC has no internet access, S3 Files requires a CloudWatch Logs VPC endpoint (com.amazonaws.REGION.logs) for mount to complete.

4. Category C — IAM Permissions

Check status:

aws s3files get-file-system --file-system-id fs-ID --region REGION

Check statusMessage. If access denied, fix the IAM role and delete/recreate.

Mount access denied: Compute role needs s3files:ClientMount. For dev/test only, AmazonS3FilesClientFullAccess is acceptable — avoid in production.

Write permission denied: Compute role needs s3files:ClientWrite

Root access denied: Compute role needs s3files:ClientRootAccess. ⚠️ Bypasses POSIX permissions — prefer access points with scoped POSIX users.

Check file system policy:

aws s3files get-file-system-policy --file-system-id fs-ID --region REGION

5. Category D — Synchronization

Files not appearing in S3: Writes sync within ~60 seconds. Check status:

getfattr -n "user.s3files.status;$(date -u +%s)" filename --only-values

Common ExportError values:

Error	Fix
S3AccessDenied	File system IAM role lacks S3 write permissions
S3BucketNotFound	Bucket deleted or renamed
RoleAssumptionFailed	Trust policy misconfigured
EncryptionKeyInaccessible	KMS key disabled or permissions revoked
PathTooLong	File path exceeds 1,024 byte S3 key limit

Monitor: PendingExports CloudWatch metric. Growing = exceeds 800 files/sec rate.

6. Category E — Conflict Resolution

Files in .s3files-lost+found-{fs-id} = sync conflict (modified via FS and S3 simultaneously). S3 wins; FS version moved to lost+found.

7. Category F — Performance

First access latency: Normal — first directory access imports metadata.

Intelligent read routing not working: Compute role needs s3:GetObject on the bucket.

Slow writes: If PendingExports growing, distribute across multiple file systems.

8. Category G — Encryption/KMS

NFS server error with encrypted FS = KMS issue. Verify key is enabled and role has KMS permissions.

9. Category H — VPC DNS

DNS resolution failure = VPC DNS settings disabled.

aws ec2 describe-vpc-attribute --vpc-id vpc-ID --attribute enableDnsHostnames
aws ec2 describe-vpc-attribute --vpc-id vpc-ID --attribute enableDnsSupport

Both MUST be true. If not:

aws ec2 modify-vpc-attribute --vpc-id vpc-ID --enable-dns-hostnames Value=true
aws ec2 modify-vpc-attribute --vpc-id vpc-ID --enable-dns-support Value=true

sudo tar -czf /tmp/s3files-logs.tar.gz /var/log/amazon/efs/ /etc/amazon/efs/s3files-utils.conf

Security Considerations

When diagnosing IAM issues, verify least-privilege — avoid FullAccess as a shortcut
Without a file system policy, any VPC client can mount
Restrict /var/log/amazon/efs/ access — logs contain S3 key names